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Summary 

A methodology for designing a failure-detection and identification (FDI) system to detect 
and isolate control-element failures in aircraft control systems has been developed by Weiss and 
Hsu (NASA CR- 1782 13), and this methodology has been extended to an adaptive FDI system. 
In this methodology, the failures are divided into two categories, aircraft path and actuator 
path, based on failure location, and an FDI subsystem is designed for each path. The actuator 
path includes those failures that occur between the flight computer output and the measurement 
of actuator position at the actuator output. The aircraft path includes those failures outboard 
of the actuator position measurement, such as damage to a control surface. The aircraft- 
path technique uses a linear model of the aircraft aerodynamics and the nonlinear equations of 
motion in an analytical redundancy scheme to generate residuals that are processed in decision 
algorithms to detect and isolate the failures. Hence, the design is for use at a single aircraft 
operating point. The actuator path similarly uses a separate simplified nonlinear model of the 
actuator and a decision algorithm for each surface, and thus the system is called a decentralized 
FDI system. The structure of the decision algorithms is selected by using a simplified design 
model of the residuals; values for the algorithm parameters, such as thresholds, are then based 
on a more accurate truth model of the residuals. The decentralized concept and the use of 
design and truth models are key to the robustness of the methodology. 

Using this methodology, a baseline FDI system design for a modified Boeing 737 airplane was 
produced by Weiss. In this report, the Weiss system, or baseline design, was evaluated in detail 
by using a six-degree-of-freedom nonlinear simulation of the airplane, including atmospheric 
turbulence based on the Dryden model. When operated in a no-turbulence environment, the 
actuator-path subsystem performed very well. All actuator- path failures stuck at neutral, 
stuck at current position, and hardover — were detected in a timely manner, and in the no- 
failure simulation runs, there were no actuator-path false alarms. The aircraft-path subsystem 
also performed well in zero turbulence. There were no false alarms, and partially missing surface 
failures of the stabilizer, rudder, elevator, and aileron were all detected when the remaining 
surface effectiveness was 60 percent. The right-stabilizer failure was isolated to the fictitious 
right horizontal tail, since the system cannot distinguish between stabilizer and elevator failures 
because of their identical effects. 

When the actuator- path subsystem was evaluated in simulation with model errors in the 
range of 5 to 15 percent, stuck-at-current-position failures were reliably detected without false 
alarms. With larger model errors (12.5 to 37.5 percent), the same failures were detected, but 
some false alarms were experienced. When the aircraft-path subsystem was operated at trim 
points in the vicinity of the design point, aircraft-path failures were reliably detected with no 
false alarms, but isolation performance was slightly degraded. At a trim point farther away 
(cruise instead of terminal area), the system was unusable because of false alarms. When 
moderate random errors were added to the aircraft-path model, the system was still able to 
detect failures at 60-percent effectiveness, but two false alarms occurred. 

In 10-ft/sec turbulence, the actuator-path subsystem continued to perform well. Again, all 
actuator-path failures were detected with no false alarms. On the other hand, the baseline 
aircraft- path subsystem was completely unusable in 10-ft/sec and higher turbulence because of 
the large number of false alarms. Examination of the residuals indicated that many of the error 
standard deviations used in the truth model were too small. Thus, new values for the truth 
model in 10-ft/sec turbulence were obtained, and two new aircraft-path subsystem designs 
(threshold (TG) and projection vector at 10-ft/sec turbulence (PV10)) were produced. Both of 
these new designs performed well in 10-ft/sec turbulence, far superior to the baseline design in 


false-alarm performance. However, performance of the new designs in zero turbulence was not 
nearly as good as that of the baseline design, so some type of adaptive design was necessary for 
operation in atmospheric turbulence. 

When a new aircraft-path subsystem (projection vector at 20-ft/sec turbulence (PV20)) was 
designed for operation in 20-ft/sec turbulence, the standard deviations of the errors for the 
truth model obtained in 20-ft/sec wind gusts had to be increased to obtain adequate false-alarm 
performance at that turbulence level. Thus, it appears that, at the higher turbulence levels, 
the design procedure needs refinement or that the method of obtaining parameter values for the 
truth model needs improvement. Nevertheless, after the truth model was adjusted, the PV20 
design performed very well in 20-ft/sec gusts. 

The design procedure was extended to produce an interpolated design for operation over a 
range of turbulence levels. This was accomplished by linearly interpolating the thresholds, gains, 
and projection vectors between their baseline, PV10, and PV20 design values based on a priori 
knowledge of the turbulence level. The interpolated design performed well over the turbulence 
range of 0 to 20 ft/sec. However, in actual flight, this a priori knowledge of the turbulence level 
is not available, and an estimate of the turbulence is required. 

A turbulence estimator based on the technique used in the NASA F-8 digital fly-by-wire 
program was developed. This technique estimates the sample standard deviation of the latest 
5 sec of turbulence. This estimator was combined with the interpolated design to produce an 
adaptive aircraft-path subsystem. This adaptive design was evaluated in 0-, 5-, 10-, 15-, and 
20-ft/sec turbulence and performed well over the entire range. It successfully detected and 
isolated all partially missing surface failures at 40-percent effectiveness, and it detected 19 out 
of 20 failures at 60-percent effectiveness. Only at the smallest failure magnitude (80-percent 
effectiveness) did performance degrade. Furthermore, in 688 sec of simulation time with no 
failures, there was only one false alarm. 

Although the decentralized FDI technique is robust to small model errors, and the extension 
of the technique to an adaptive system allows the system to operate in atmospheric turbulence, 
problems remain to be solved in the development of an operational FDI system. The two most 
urgent needs are (1) the continuation of work to extend the system from a single operating point 
to operation over the entire operating envelope of the aircraft and (2) flight testing to provide 
more realistic noise, or error, values for the truth models and to provide reliable false-alarm 
evaluation. 

Introduction 

For certain anticipated failures in the operation of transport aircraft, there are established 
procedures for the pilot to follow. A typical example is the procedure for handling an engine 
outage during takeoff. There are, however, unanticipated failure modes for which no appropriate 
emergency procedures are available. These unanticipated failures must be handled by the pilot 
and/or the automatic control system in real time to decrease the probability of a tragic accident. 

In the case of a hardover (maximum surface deflection) failure in a control element, the 
pilot may have only a matter of seconds to take corrective action before the aircraft reaches 
an irrecoverable condition. In the case of a failure of lesser magnitude, the pilot may have 
more time to take corrective action, but the failure and, hence, the proper corrective action 
may be difficult to identify. In either case, the pilot may require assistance from the aircraft 
systems to help determine the appropriate corrective action in a timely manner. A restructurable 
flight control system (RFCS) is designed to provide such assistance in these emergencies. The 
RFCS automatically restructures the control system to utilize the remaining useful control 
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effectors to recover from the emergency and to provide stability and control augmentation when 
sufficient control power remains. A crucial component of the RFCS is the failure-detection and 
identification (FDI) system, which detects the occurrence of a control-element failure, identifies 
the failed elements, and provides needed failure information to the other RFCS components. 

A considerable amount of work has been done in the area of failure detection and identifica- 
tion in dynamic systems, and Willsky has provided a well-known survey of many of the available 
FDI techniques (ref. 1). Chow (ref. 2) and Chow and Willsky (ref. 3) have examined the problem 
of generating residuals from the system measurement data for use in decision-making processes 
to detect and identify failures. The detection of failures in sensors has been investigated in 
references 4 to 7. The generalized likelihood ratio has been investigated for FDI applications 
in references 8 to 18. This technique has been exercised in a simplified simulation of the F-8 
aircraft dynamics (refs. 9 to 12), in a linear simulation of the Boeing 737 aircraft longitudinal 
dynamics (ref. 18), and in a six-degree-of-freedom nonlinear simulation of the C-130 aircraft 
(refs. 15 to 17). Another FDI technique is the failure-detection filter. Beard (ref. 19) developed 
the theory of the failure-detection filter for linear deterministic continuous systems by using a 
matrix-algebra approach. Jones (ref. 20) extended this theory to stochastic and sampled data 
systems by using a vector space approach. Meserole (ref. 21) has applied the failure-detection 
filter to the problem of detecting and identifying failures in an F-100 jet engine. This technique 
has been applied to the problem of detecting and identifying control-element failures in aircraft 
in references 15 and 22 for the C-130 and 737, respectively. Early work on restructurable or 
reconfigurable flight control systems was done by Boudreau and Berman (ref. 23). In a later 
effort, Caglayan et al. (ref. 24) investigated RFCS design. Their FDI approach was to use 
a Kalman filter followed by a bank of first-order filters and likelihood-ratio computers and a 
multiple- hypothesis test. 

One of the difficulties with the FDI techniques previously mentioned is their lack of robustness 
to model errors. Weiss and his colleagues (refs. 25 to 27) have developed an FDI design 
methodology aimed at improving this robustness to model errors. Like the aforementioned 
techniques, this approach, which they call decentralized FDI, utilizes analytical redundancy. 
However, unlike the previous approaches which use a central filter, their technique uses only 
the most reliable information in these analytical-redundancy relationships, and thus increases 
robustness with only a small loss in optimality. They have applied this technique to transport 
aircraft (refs. 25 to 29), high-performance aircraft (refs. 30 and 31), and jet engines (refs. 32 
and 33). A forerunner of this approach was used in the NASA F-8 digital fly- by- wire program 
(ref. 34) to detect sensor failures. 

The primary purposes of this report are to present a more thorough evaluation via simulation 
of the performance of Weiss’s FDI design than was contained in reference 25, including the effects 
of atmospheric turbulence and model errors; to describe an extension to Weiss’s design, namely, 
an adaptive FDI system, for operation in turbulence; and to present a simulation evaluation 
of this adaptive system. Secondary purposes of this report are to present a review of Weiss’s 
design methodology for completeness and to present additional details concerning a few areas 
of the design that are not found in reference 25. 

The report is organized as follows: The design concept, or methodology, is presented first, 
followed by numerical results from the design procedure for the baseline system designed by 
Weiss. Results of a thorough simulation evaluation of the baseline design are next, followed 
by modifications to the design for operation in turbulence and results of an evaluation of these 
modifications. A description and an evaluation of an algorithm to estimate the level (standard 
deviation) of turbulence are then presented, followed by a description of an adaptive FDI design 
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and a presentation of the results of an evaluation of this design. The final section contains a 
summary of results and conclusions. 


Symbols 

Some variables are listed with the general subscript £. In these cases, specific subscripts 
are defined under the subheading “Subscripts.” Bold capital letters indicate matrices, and bold 
lower-case letters indicate vectors. A dot over a symbol indicates a derivative with respect to 
time. An asterisk over a symbol indicates an averaged quantity. 
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system transition matrix 
accelerometer measurement, ft /sec 2 

accelerometer measurement after compensation for off-center-of- 
gravity effects, ft /sec 2 

acceleration, ft/sec 2 

filter constant for high-pass filter in error model 

filter constant for low-pass filter in error model 

system input, or control, matrix 

jth column of B matrix 

reference wing span, ft 

nondimensional aerodynamic coefficient 

constant term in series expansion of C £ accounting for forces or 
moments at trim condition 

derivative of C £ with respect to £ 

failure isolated to confusion set consisting of surfaces listed in 
parentheses 

reference wing chord, ft 

metric defined by equation (36) 

worst-case error, deg 

engine pressure ratio 

accelerometer measurement error, ft /sec 2 

pass-fail flag for ith failure test 

effective failure magnitude, deg 

minimum failure magnitude to achieve desired value of d 2 metric, 
deg 

gain in turbulence estimator 
SPRT gains 

turbulence estimator gain 
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g> 9 

n 

acceleration due to gravity, ft/ sec ^ 

H 

system output, or observation, matrix 

Hi 

hypothesis that the ith component has failed 

H i 

hypothesis that a failure has occurred 

H o 

hypothesis that no failure has occurred 

I zx 

2 

product of inertia in zx-plane, ft-lb-sec 

k 

2 

moment of inertia about £-axis, ft-lb-sec 

K a 

multiplicative factor used in computing threshold 

k 

sample number 

k f 

sample number (time) when failure occurs 

k T 

sample number at which trigger test passes and initiates the verify 
test 

h 

sample number at which value of equivalent statistic equals or 
exceeds threshold 

L 

aerodynamic and propulsive moment about x-axis, ft-lb 

LA 

left aileron 

LE 

left elevator 

LS 

left stabilizer 

LT 

left thrust 

k 

£~axis coordinate of sensor relative to center of gravity, ft 

M 

aerodynamic and propulsive moment about y-axis, ft-lb 

m 

mass of aircraft, slugs 

N 

aerodynamic and propulsive moment about z-axis, ft-lb, or num- 
ber of samples 

Hi 

maximum number of samples in isolate test 

n t 

number of samples in trigger test 

N v 

maximum number of samples in verify test 

ND 

failure not detected 

n(k), n(k ) 

Gaussian noise sequence 

P 

total roll rate, rad/sec or deg/sec 

P(fc) 

covariance matrix of state in error model 

Pd 

probability of detection 

Pe 

probability of error 

P FA 

probability of false alarm 

Pi 

trigger, verify projection vector for ith failure 
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p */j 

P M 
P , q,r 
Pm 

Q 

Q 
Q o 

q 

qm 

R 

RA 

RE 

RS 

RT 

Ru 

r m 

S 

s (N), S(N ) 

Si 

S h/J (k - k T + 1) 

s' T 

s v 

Sii(k — kj' 4 - 1 ), 
S^j ( k — kji + 1 ) 

S^k) 

s, s 
s 

TURB 

TURBL, TURBM, 
TURBH 

t L 


isolation projection vector for zth failure more likely than jth 
failure 

probability of missed detection 

body-axis attitude rates, rad/sec or deg/sec 

measured perturbed roll rate, rad/sec 

covariance matrix of noise input to the error model 

total pitch rate, rad/sec or deg/sec 

pitch rate at trim, rad/sec 

dynamic pressure, lb/ft 2 

measured perturbed pitch rate, rad /sec 

total yaw rate, rad/sec or deg/sec 

right aileron 

right elevator 

right stabilizer 

right thrust 

rudder 

measured perturbed yaw rate, rad/sec 

reference wing area, ft 2 

sum of N residuals 

isolation-test statistic 

test statistic in aircraft-path isolation test 

trigger-test statistic in aircraft path 

trigger-test statistic in actuator path 

verify-test statistic 

sum of 7 j(m), 7 j(m) from m = to m = k 

equivalent statistic 
failure signal 

value of failure signal s that is reliable according to d 2 metric, deg 
or lb x 10 3 

specified or estimated value of standard deviation of turbulence, 
used as independent variable in interpolation, ft /sec 

low, medium, and high break 

points of independent variable in linear interpolation 
lower threshold in sequential probability ratio test 
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t T 

l u 

ty 

*6 

U 

U () 

u(k) 

V 

F 

V(fc) 

F:as 

V m (fe) 

V F (jfc) 

V T 

V T m 

V T 0 

W 

W (&) 

wd( k ) 

w e ( k ) 

W 0 

X 

x,y,z 

x(fc) 

x M (k) 

x Si( k ) 

Y 

YL, YM , 7F 

y( k ) 

Um 

Z 


trigger threshold 

upper threshold in sequential probability ratio test 

verify threshold 

threshold for ith failure test 

speed in x-direction, ft/sec 

undetermined failure of one of the surfaces listed in parentheses 

x-velocity at trim, ft/sec 

vector sequence of control inputs 

inertial velocity, ft /sec 

speed in y-direction, ft /sec 

estimated velocity, ft/sec 

calibrated airspeed, knots 

measured velocity relative to air mass, ft /sec 

predicted velocity, ft/sec 

true airspeed, ft /sec 

measured true airspeed, ft /sec 

true airspeed at trim, ft/sec 

speed in ^-direction, ft /sec 

noise input in state-space model 

noise input to high-pass filter in error model 

white Gaussian noise input to low-frequency error model 

z - velocity at trim, ft/sec 

total aerodynamic and propulsive force in x-direction, lb 
aircraft body axes 
state vector 

output of high-pass-filtered error model 

output of low-pass filter in high-pass-filtered error model 

state variable in model of error in S(N) 

total aerodynamic and propulsive force in y-direction, lb 

low, medium, and high break points of dependent variable in 
linear interpolation 

vector sequence of outputs, or observations 
sensor measurement 

total aerodynamic and propulsive force in z-direction, lb 
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a m 
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a 0 

(3 

(3m 
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( 3 0 

7 j(m) 

A 

At 

6 

6a 

6c 

6m 

Smi 

e{k) 

m 

e 
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v(h), v(k) 

v i 

S / 


a 



angle of attack, deg 

measured total angle of attack, rad or deg 

measured perturbed angle of attack after compensation for atti- 
tude rate effects, rad or deg 

angle of attack at trim, rad or deg 

sideslip angle, deg 

measured total sideslip angle, rad or deg 

measured perturbed sideslip angle after compensation for attitude 
rate effects, rad or deg 

sideslip angle at trim, rad or deg 

residual sequence after projection and filtering 

total deflection, deg or lb x 10 3 

sample interval, sec 

deflection relative to trim value, deg or lb x 10 3 
true actuator position 
commanded actuator position 
measured actuator position 

measured perturbed deflection of zth control surface, deg 

measurement error sequence, ft /sec 

sequence of residuals in turbulence estimator 

total pitch angle, deg 

total pitch angle, rad or deg 

log likelihood ratio 

residual 

sequence of residuals 

force or moment residual, ft/sec^ or rad/sec 
covariance matrix of S(N) 

covariance matrix of low-frequency error sequence n^(/c) 
covariance matrix of white-noise sequence nw(fc) 
standard deviation, ft /sec 
variance 

variance of S(N) 

specified standard deviation of simulated turbulence, ft/sec 
variance of scalar low-frequency error sequence 
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(Jj^ 

°u 


a v 


<T W 


2 

a w 
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¥ 

UJ 


Subscripts: 

d 

E 

h 

I 

i 

3 

LA 

LE 

LH 

LS 

LT 

l 


771 

77 

RA 

RE 

RH 

RS 


variance of S(k) 

variance of Sj.^(k — kj^ + 1) 

sample standard deviation of simulated turbulence, ft /sec 

sample standard deviation of ^-component of simulated 
turbulence, ft/sec 

sample standard deviation of y-component of simulated 
turbulence, ft /sec 

sample standard deviation of ^-component of simulated 
turbulence, ft /sec 

variance of scalar white-noise sequence n w (k) 

total bank angle, rad or deg 

total heading angle, rad or deg 

attitude rate, rad/sec 

actuator-model cutoff frequency, rad/sec 

component of design model 
elevator 

after high-pass filtering 

isolate test 

ith component 

j th component 

left aileron 

left elevator 

left horizontal tail 

left stabilizer 

left thrust 

moment about x-axis 

low-frequency component of error (noise), or moment about x-axis 

measured quantity, or moment about y-axis 

moment about z-axis 

right aileron 

right elevator 

right horizontal tail 

right stabilizer 
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RT 

Ru 

Sp 

T 

Th 

Tl 

t 

V 

w 

X,Y,Z 

x,y,z 

6A 

6E 

6R 

6S 

6Sp 

6T 

P 

Superscripts: 

c 

P 

T 

* 

Operators: 

E{ } 

var ( ) 

Abbreviations: 

BL 

FDI 

HPF 

LPF 

PV10 


right thrust 

rudder 

spoiler 

trigger test 

thrust 

throttle 

component of truth model 
verify test 
white noise 

force along x- 5 y-, or z-axis 
along or about x y-, or z-body axis 
aileron deflection about nominal (trim) 
elevator deflection about nominal (trim) 
rudder deflection about nominal (trim) 
stabilizer deflection about nominal (trim) 
spoiler deflection about nominal (trim) 
thrust perturbation about nominal (trim) 
x-, y-, or z-channel in turbulence estimator 

after compensation 
predicted value 
transpose of a matrix 

denotes averaged over two successive samples 

statistical expected value 
estimate 

statistical variance 
baseline 

failure detection and 
identification 

high-pass filter 

low-pass filter 

projection vector at 10- ft /sec turbulence 
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PV20 projection vector at 20- ft /sec turbulence 

RFCS restructurable flight control system 

SPRT sequential probability ratio test 

TG threshold 

Baseline Design 

Design Concept 

Failure detection and isolation is the process of detecting abnormal, or out-of-tolerance, 
behavior in a system and isolating the source of the abnormality to a subsystem or component. 
One method of accomplishing this is to examine the system outputs, or perhaps the subsystem 
outputs. For example, the power output of an RF (radio frequency) transmitter could be 
measured, and if the power were outside of limits established by previous testing, the transmitter 
could be declared failed. In this way, detection and isolation to the transmitter subsystem level 
are performed in a single operation. Of course, this procedure is reliable only if the power 
measurement is more reliable than the transmitter. A common technique for detecting failures 
in redundant sensors, where three or more sensors measure the same quantity, is a voting scheme 
whereby the outputs of the sensors are compared with each other. If one of the outputs differs 
from the others by more than normal tolerance, that sensor is considered failed. 

The FDI system for aircraft control elements poses a slightly different problem. Unlike the 
transmitter, the output (position) of the actuators used to move the control surfaces cannot 
be compared with a constant, because the output depends on the input. On the other hand, 
the actuators are not triply replicated, so their outputs cannot be compared with each other. 
Moreover, the effective outputs of the control surfaces are the aerodynamic forces and moments 
that are exerted on the aircraft, and these forces and moments are not measured directly. In 
these cases, some form of analytic redundancy must be used to form a set of normal predicted 
measurements with which a similar set of actual measurements can be compared. Several 
such techniques utilize a central filter, which uses a model of the aircraft dynamics to predict 
aircraft performance, compares this prediction to measured performance, and generates a set of 
residuals whose behavior is used to detect and isolate failures. Some of these methods, such as 
the generalized likelihood ratio, failure-detection filter, and a bank of Kalman filters, have been 
investigated for application to the FDI problem in aircraft control systems. (See refs. 9 to 12, 15 
to 18, and 22.) One of the major problems with these techniques is that errors in the models used 
by the central filter produce abnormalities in the residuals, which are difficult to distinguish from 
a system failure. Thus, one of the major thrusts of the investigation discussed in this report was 
to develop an FDI system that was robust to model errors. Weiss and his colleagues conceived 
such a system, which they call decentralized FDI, developed a design methodology, and used 
this methodology to design a decentralized FDI system for the 737 aircraft. The remainder 
of this section presents a review' of, and in a few cases an expansion of, the methodology and 
design from their report. 

Subsystems 

A major step in the direction of robustness was the division of the FDI system into separate 
subsystems: the actuator-path subsystem and the aircraft-path subsystem. The actuator-path 
subsystem was designed to detect and isolate failures that occur between the measurement 
of actuator input (control system command to the actuator) and the measurement of actuator 
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output position. (See fig. 1.) The aircraft-path subsystem was designed to detect control-element 
failures that occur outboard of the actuator position measurement. Such failures include broken 
linkages or hinges and control surfaces that are damaged or partially missing. 
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Aircraft 

path 





Aircraft 

states 


Figure 1. Definition of failure paths. 

The actuator-path subsystem consists of a separate FDI element for each actuator. As 
shown in figure 2, each element operates as follows: The system contains a model of the 
actuator dynamics, where the complexity of the model depends on the complexity of the 
actuator dynamics and on the desired sensitivity of the FDI system. The actuator command is 
input to the model, and a predicted actuator response (output position) is computed. This 
predicted output is then compared with the measured output of the real actuator, and a 
residual is generated. During normal operation, this residual would be near zero, since the 
predicted output would agree with the measured output with an accuracy that depended on the 
accuracy of the model and the error in the measurement. This residual is then processed by a 
decision algorithm to detect a failure. Since there is a separate FDI element for each actuator, 
failure detection also serves as failure isolation, and multiple actuator-path failures are easily 
accommodated. With this technique, robustness is served because the model is that of the 
actuator, whose dynamics should be better known than those of the entire aircraft, and because 
the measurements used should be less noisy than some aircraft performance measurements, such 
as angular accelerations. 


Command 



FDI 

decisions 


Figure 2. Typical element of actuator-path subsystem. 


The design of the aircraft-path subsystem assumes that hinge-moment measurements for 
each of the control surfaces are not available. Therefore, as shown in figure 3, this subsystem 
must utilize measurements of the aircraft dynamic response to commanded maneuvers to detect 
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and isolate failures. A linear model of the aerodynamics at the selected operating point, or 
flight condition, is used to predict the forces and moments acting on the aircraft based on 
the aircraft state and the measured surface positions. The nonlinear equations of motion and 
sensor models are then used to predict angular and linear acceleration measurements in body 
coordinates. These predictions are compared with the measured quantities to form residuals 
that are processed in a decision algorithm to detect and isolate aircraft-path failures. The 
current design does not accommodate multiple aircraft-path failures. 
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decisions 


Figure 3. Aircraft- path subsystem. 


Decision Process 

The general pattern is to make measurements of the response of the system, either the aircraft 
or an actuator, to compare that measurement with a calculated measurement that was produced 
by using a model of the system, and to use the residuals that result from this comparison in a 
decision mechanism. To achieve the desired missed-detection/false-alarm performance in a noisy 
environment, while providing quick response to a failure when the failure time is unknown, the 
decision process is structured as a set of trigger-verify-isolate tests as shown in figure 4. All 
three of the tests are designed as statistical hypotheses tests. 


Residuals 



o Minimum time 


Detection 

decision 


Isolation 

decision 


Figure 4. Structure of decision process. 


The trigger, verify, and isolate tests each use the vector of residuals as an input. The problem 
is to determine whether or not the residuals are “normal,” that is, whether the residuals result 
from an unfailed system or from a failed system. The structure of these tests is determined by 
using a simplified design model for the residuals; this model assumes that the vector sequence 
of residuals is composed of two parts: (1) a slowly varying signal vector that can be considered 
constant for the duration of the test and is present only during a failure, and (2) a white Gaussian 
noise vector that results from sensor noise and quantization noise. Once the test structure is 
chosen, the parameters of the test are selected by using a more complete truth model for the 
residuals, a model that includes other sources of error, such as biases and system model errors. 
This procedure, which uses a design model to determine the algorithm structure and a truth 
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model to determine values for the algorithm parameters, is intended to increase the robustness 
of the design. 

Single Operating Point 

The FDI system discussed in this report utilized a linear model of the aircraft aerodynamics 
in the system design; that is, the aerodynamic forces and moments acting on the aircraft 
were assumed to be linear functions of the aircraft states and of the control deflections. This 
assumption is valid only over a limited portion of the aircraft operating envelope. Therefore, 
the FDI system design presented herein is single-point design. In this case, the operating point 
for the modified 737 is described in table 1. 


Table 1. Aircraft Operating Point for FDI System Design 
[Landing gear up] 


Altitude, ft 3500 

Indicated airspeed, knots 100 

Flight-path angle, deg 0 

Flap angle, deg 15 


Design Methodology 

Actuator-Path Subsystem 

Residual generation. In the actuator-path subsystem, a sequence of residuals v(k) is 
generated by comparing the measured output position of the actual actuator with the position 
that was computed by using a nonlinear model of the actuator as shown in figure 5. In general, 
the actuator model includes a single-pole linear transfer function, a rate limiter, a position 
limiter, and a cable stretch factor. The model input is the actuator position command generated 
by the flight control system. The model output (computed actuator position) is compared with 
a measurement of the actual position, and the measurement includes a bias and additive white 
Gaussian noise and is assumed to occur somewhere between the actuator rod and the surface 
hinge, inclusively. The model is single-input /single-output, such that the residual vector is one 
dimensional, or a scalar sequence. In a flight system, errors would be introduced into the model 
output, and thus into the residuals, by such things as unmodeled high-frequency dynamics, 
hysteresis effects, and variations from one set of hardware to another. 



Figure 5. Actuator- path residual generation. 
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The model for the engines is more complex. Commanded thrust is the input, and engine 
pressure ratio (EPR) is the actual measurement. The EPR is converted to “measured” thrust 
by using a transformation that is a function of altitude. The rate limit is a function of the 
current thrust and is different for engine spool-up and spool-down. 


Design model The residuals generated as in the preceding section are assumed to be 
composed of a zero-mean, white Gaussian random component, which accounts for sensor noise 
and quantization error, and a low-frequency error component. When a failure has occurred, 
there is a time-varying component that results from the failure; this component is the signal 
that must be detected to indicate a failure. For design purposes, it is assumed that this time 
variation is slow compared with the detection time of 0.5 to 2 sec. Therefore, to determine the 
structure of the decision tests, the signal s is assumed constant, and the low-frequency error 
term is ignored. The design model of the residual is then 


H\\ v d (k) = s + n w (k) 
Hq: u d {k) = n w (k) 


(1) 


where s is the failure signal and n w (k) is white Gaussian noise. The conditional probability 
density function for v d (k) is 


H\-P{u d {k)\Hi) = . 1 exp [- (^-s) 2 /2a^j 

V 

#0 : P Mk)\H 0 ) = d=_ exp [-^/2«4 ] 

V 2 


( 2 ) 


where a 


2 

w 


is the variance of n w (k ). 


Truth model The truth model for the residuals used in determining the parameters of 
the tests includes a low-frequency noise term n^{k) to account for sensor biases and other 
model errors. As noted previously, the decision process assumes that the random component 
of the residual is white. Therefore, a high-pass whitening prefilter is used between the residual 
generator and the decision algorithm to decorrelate the residual noise. The filter cutoff frequency 
is chosen to be less than the inverse of the detection time to preserve the coherence of the signal. 
The truth model for the residuals then becomes 


i'i (/c) — Sfa + n £h(^) 
H 0 : vt(k) = 


( 3 ) 


where the subscript h denotes the quantity after high-pass filtering, and aj is the variance of 
the low-frequency noise before high-pass filtering. 

To improve detection performance, the decision process utilizes a signal S(N ) that is the 
sum of the residuals over N samples; that is, 


N 

S(N ) = Y, "dk) 


k = 1 


( 4 ) 
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The variance cr'j of S(N) can be approximated as aj- = N^oj + No^,. To determine the variance 

CT| more accurately, first express the random portion of the process as the output of a 

linear system. Let the linear system be expressed in state-space form as follows: 

x(k + 1) = Ax(fc) + B w(k) 
y (k) = Hx(A;) 

With reference to figure 6, the low-pass noise ng(k) can be expressed as the output of a low-pass 
filter driven by zero-mean, white Gaussian noise wg(k) as follows: 

ng(k + 1) = agngik) + (1 — ag)wg(k ) ( 6 ) 




Figure 6. Truth model of residual noise process. 


Let w^(k) be the sum of ng(k) and n w (k ). The high-pass-filtered noise x^(k) can be modeled as 
the difference between noise w^(k) and the output x^g(k) of a low-pass filter driven by w^(k)] 
that is 



w d{k) = ng(k) + n w (k ) 

( 7 ) 

and 

x he( k + 1) = a M x hii k ) + (i - a ht ) w d ( k ) 

(8) 

Combining equations (7) and (8) gives 



x he( k + 1) = a M x hd k ) + (i - a he) n e ( k ) + (i - a he) n w ( k ) 

( 9 ) 

and 

x h {k) = w d {k) - x M {k) 

(10) 


The output Xh(k) of the high-pass filter is the input to the summation function, which sums 
the input over N samples as follows: 


k 

n ( k ) = x a(0 

i=fc-jV+l 


(ii) 


The summation function can be modeled as an JV-state linear system, where each state xg .(k) 
only provides a one-sample delay and the output matrix provides the summation. 
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We now combine equations (6) to (11) into the state-space system described by equations (5). 
The resulting system is described by the following system of equations. 


x(k) = 


xi(k) 
x 2 {k) 
x 3 (k) 
x 4(fc) 


’ n e {k) 

x hi( k ) 

X S\ (^) 

x s 2 ( fc ) 


( 12 ) 


l x N+2( k )\ 




w(fc) = 

wi{k) 

w 2 {k) _ 


n w (k) 

wg(k) 



a i 

0 

0 

0 

0 

0 

(! - a hl) 

a M 

0 

0 ••• 

0 

0 

1 

-1 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

0 

0 

0 

1 ••• 

0 

0 


o o 


B = 


0 

(i - a he) 

l 

o 


(i - hY 
o 
0 
0 


(13) 


(14) 


(15) 


L o o J 

H = [0 0 1 1 1] ( 16 ) 

where 

A = AT + 2xjV + 2,B = N-i-2x2, and H = 1 x N + 2 
The system output y{k) is the noise sequence n(k) in the truth model after summing over N 
samples; that is 

n(k ) — y{k ) (1 v 

The covariance matrix P(fc) of the system state x(fc) can be found by solving the Lyapunov 
equation as follows: 

E{x(k + 1 )x T (fc + 1)} =AB{x(fc)x T (fc))A T + AE{x(fc)w T (fc)}B T 

+ BE{w(fc)x T (fc)}A T + BE{w{k)w T (k)}B T 


17 



P (k + 1) = AP(fc)A T -|- BQB r 

where 



Lo „?J 

In the steady state as k approaches infinity, equation (18) becomes 


(18) 

(19) 


P = apa t + bqb t 


(20) 


The solution for the variance 


of the noise n(k) in the truth model can then be found from 


aj = HPH r 

This value is then used in the statistical hypotheses tests. 


( 21 ) 


Trigger test. To detect the potential presence of a failure that, according to the design model, 
results in a constant of unknown magnitude and sign in white Gaussian noise, the trigger test 
is designed to perform a Bayesian hypothesis test on a fixed sample length of residuals. This 
is accomplished by computing the log likelihood ratio Ay(fc) of the most recent Ay residuals, 
taking the absolute value of A T (k), and comparing the result to a threshold. A window of 
Ay residuals is used rather than a single sample to increase the signal-to-noise ratio, and the 
window of fixed sample length is updated every iteration to account for the unknown onset time 
of the failure. 

Since the v ( k ) s are independent according to the design model, the log likelihood ratio based 
on the probability density function in equations (2) is given by 


Ay(fc) - ln< 


p [l^ (A: — Ay + 1) , t/(fe — Ay + 2) , v[k)\Hi) 
p{v{k- Ay + 1), v {k - Ay + 2) , •••, i/(k)\Ho\ 


- E 


su(i) 


i=k-N T +l 


'w 


2a 


(22) 


where p [ v{k — Ay + 1), v{k — Ay + 2), • - • , i/(k)\Hj] is the joint conditional probability den- 
sity function of the most recent Ay residuals (given H^). Instead of using Ay(fc), the trigger 
test utilizes an equivalent statistic Sy(A:) given by 

k 

S T (k) = (1/Ay) J2 K0 (23) 

i=k— N t+1 


Since the v{ky s are independent, Sj^(k) is Gaussian with variance = cr^/N-p and mean 
zero under Hq and mean s under Hi. The trigger test becomes 


|Sr(*)l 


> ty, then Hi 
< t'p, then Hq 


(24) 
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To determine the threshold ty, first consider the design model for the residuals. The 
probability of false alarm (choosing the hypothesis H\ when Hq is true) is given by the integral 


ro q 

P FA = 2/ p(S T \H 0 ) dS T 

J It 


/ tj 1 
roc 


= 2 f T== ex P (- S t/ 2(T S t ) dS T 

Jt'T . V ' 


(25) 


t T \f 2ira S T 

The threshold tj 1 is chosen to achieve the desired false- alarm rate; that is 

t T = K(j(Jg T 


(26) 


For example, a PpA °f 1 x 10 - ^ results in K& — 3.3, or tj 1 = 3.3a^. 

Now that the structure of the trigger test has been chosen, the whitening prefilter is inserted, 
and equations (5) to (21) are used to compute the variance of the test statistic S r p(k) using 
the truth model. The truth-model variance is then used in equation (26) to determine the 
threshold The resulting trigger test is shown in figure 7. 


u(k) 



Trigger 


Figure 7. Actuator-path trigger test. 


Verify test. The output of the trigger test is used to initiate the verify test, which is structured 
as a sequential probability ratio test (SPRT) as shown in figure 8. It has been shown (ref. 35) 
that, on the average, the SPRT decides between two hypotheses in a shorter time than a fixed- 
length test. If, in the design model (eqs. (1)), the signal s is a known constant, then at each 
sample time k after initiation of the test, the standard SPRT computes the likelihood ratio 
Ay(k') as in equation (22). The likelihood ratio is then compared with two thresholds. If the 
ratio exceeds the upper threshold, hypothesis H\ is accepted, and if the ratio is less than the 
lower threshold, hypothesis Hq is accepted (or Hi rejected). If the ratio is between the two 
thresholds, another sample is taken and the test is repeated. Mathematically, this procedure is 
expressed as follows: 


A y{k) = 


p [v (%-), v{k T + 1) , v(k)\Hi\ 


p[v(k T ) , u(k T + 1) , 
sis(i) s ^ 


, m m 


— exp 


k 

E 

[i=k T 


' w 


2a 


w 


( 27 ) 


If Ay(k) > tjj , then decide H\ 

If ti < A y(k) < tjj, then take another sample 

If A y(k) < ti, then decide Hq 
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Verify 


u(k) 



Figure 8. Actuator-path verify test. 


It has been shown (ref. 35) that if and Py\ are the desired missed-detection and false-alarm 

probabilities, then the thresholds should be set to 

tu='- PM 

u Pfa 

(28) 

and 

tL = pm 
L i ~Pfa 

(29) 

If the desired missed-detection and false-alarm probabilities are equal, then the test is symmet- 
rical, and the thresholds become 

= ~ l L = W 

(30) 

Instead of the likelihood ratio Ay(k), the sufficient statistic Sy(k ) can 
notational simplicity k is redefined to begin when the trigger test passes) 

be used, where (for 

k 

SvW = J2 [x(0 - 1] 
2=1 

(31) 

If Sy(k) > ty , then decide H\ 


If — ty < Sy(k ) < ty, then take another sample 


If Sy(k) < — ty, then decide Hq 


From equations (27) and (31), 


ty = ( CT w/ s ) ln (*t/) 

(32) 


As a preface to designing the verify test with the truth model, a few characteristics of the 
design-model verify test should be discussed. First, the conditional expected values of the test 
statistic Sy(k) are 


= y (33) 

and 

E{S v (k)\H 0 } = -^ (34) 

Also, the variance of the test statistic, independent of the hypothesis, is given by 

a S v ( k ) = kt7 w (35) 
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Consider a measure d 2 of the ability of a signal y to distinguish between two hypotheses H 0 
and H\, where the d 2 metric is defined by (ref. 25) 


.2 

L var (y) 


(36) 


The d 2 metric is then a measure of the distance between the means of the signal under the two 
hypotheses normalized by the standard deviation of the signal. For the test statistic Sy(k), d 
can be determined by using equations (33) to (36) as follows: 


d 2 (k) = 


ks x 


7 W 


(37) 


Furthermore, at sample kf when the expected value of the test signal equals the threshold, that 
is, when 

= ( 38 ) 


then d 2 (kt) is given by 


d 2 (k t ) 


2 sty 


<?w 


= 2 In 




- p m \ 


(39) 


p FA ) 

These relationships will be used subsequently. 

Thus far we have structured the verify test as an SPRT and have seen how the parameters 
can be chosen for the design model, that is, for the case of a constant in white Gaussian noise. 
Selecting the parameter values for the truth model is more difficult than for the trigger test. 
First of all, provisions must be made to assure that the test does not continue indefinitely 
without making a decision. Thus, if the test has not made a decision after Ny samples, the test 
will be terminated and a false trigger will be declared. 

Following the procedure developed by Weiss (ref. 25), the gains G a <md G jy and the threshold 
ty will be selected. The procedure is as follows: 

1. Determine what value s of the failure signal s will produce a verify test at sample Ny 
that is reliable according to the d 2 metric; that is, solve the following equation for s: 


d 2 (Ny) = 


NyS 2 


T S V 


(Ny) 


= (2K a )‘ 


(40) 


where 2 K a is the desired normalized distance between the means of Sy(AV) for reliable 
detection, and ls var i ance of Sy(Ny)^ which is calculated as presented 

previously by using the model for Sy(Ny) and solving the appropriate Lyapunov 
equation. 

2. From figure 8, let 

G A = 1) 

Oo-\} 

3. Determine the value k t of k for which the d 2 metric equals or exceeds 2 In [(1 - Pe)/Pe\' 
that is, from equations (36) and (39) solve the following for k t : 


k 2 s 2 


d 2 (S v (k t )) = - ^-y>2 1n 




(t?) 


(42) 
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4. Set the threshold ty equal to the mean value of S(k) at k = as follows: 

t v = E{S v (k t )\H l } ( 43 ) 

This completes the design of the verify test with one exception. Since the sign of the failure 
signal s is unknown, take the absolute value of the sum of the residuals to form Sy(k). The 
resulting configuration of the verify test is shown in figure 8. 


Aircraft-Path Subsystem 


Residual generation. The design of the aircraft-path subsystem must detect failures that 
occur outboard of the measurements of the actuator positions, failures such as a partially 
missing surface. When a failure of this type occurs, the response of the aircraft is different 
from the response that would normally be produced by the commands or controls. If this 
response is measured, and if a model could be used to predict the normal (unfailed) response to 
the commands in effect, then perhaps these responses could be compared to detect and isolate 
the failure. Thus, the first element in the aircraft-path subsystem is a residual generator, which 
utilizes measurements related to the aircraft state, measurements of the actuator positions, a 
linear model of the aircraft aerodynamics, and the nonlinear equations of motion in the residual- 
generation process. 

To understand this residual-generation process in more detail, assume a rigid-body aircraft 
that is symmetrical with respect to the rrz-plane, and neglect the rotation of the Earth. The 
equations of motion in body axes are (ref. 36) 


X - mg sin 6 = m (it + QW — Rv'j ^ 
Y + mg cos 9 sin = m + RU — Pw'j 
Z + mg cos 9 cos $ = m (w + PV - Qu'j 
L = I X P — I zx ^R 4 - PQ^j — (iy — I z ) QR 
M = IyQ - I zx ( R 2 - P 2 ) - (I z - I x ) RP 

N = I Z R — I zx (P ~ QR) ~ (Ix ~ Iy) PQ J 


(44) 


Uppercase symbols have been used to denote total quantities rather than perturbed quantities. 
Consider the first three equations of equations (44), which describe the translational dynamics 
of the aircraft. These can be arranged in units of linear acceleration as follows: 


X/m = U + QW - RV -I- gsmO 
Y/m = V + RU — PW — g cos 9 sin $ > 
Z/m — W + PV — QU — g cos 9 cos $ . 


(45) 
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The quantities on the right side of equations (45) are the specific forces that are measured 
by the body-mounted accelerometers; that is, the accelerometer measurements at the center of 
gravity are 


A„ lx = U + QW - RV + g sin 6 + e x 
Am y = V + RU — PW — g cos 8 sin $ + e y > 
Am z = W + PV — QU — g cos 6 cos + e z 


(46) 


where ej is the measurement error. 

If a model of the aircraft aerodynamics could be used to compute predicted values for the 
forces X, Y, and Z as functions of the aircraft state and the control-surface positions, we 
could compare these predictions with the accelerometei measurements to form residuals. These 
residuals would normally (no failures) be zero except for noise and model errors. To compute 
these predicted values, consider that estimates X , Y, and Z of the forces can be expressed as 
functions of the nondimensional coefficients as follows: 


X = qSC x ' 

Y = qSCy > ( 47 ) 


Z = qSC z 


where q is the dynamic pressure and S is the reference wing area. In the vicinity of a single- 
aircraft operating point, such as the one given in table 1, the coefficients can be approximated 
as a truncated Taylor series that retains only the first derivatives as follows: 


C x = C x 0 + C Xn a^ n + -rrr-C Xq q m + ^ C Xfi Pm t 

T 0 i 

Cy — C y(j + Cypfim + (Cy p Pm + Cy^n^j + ^ Cy^ 6 rrll 


C z = C Z0 + Cz a O^m + ^77 C Zq qm + ^ C Zt) _ ^rn t 
z v Tq i 


(48) 


In equations (48) the air-data variables a ^ and P C m, the body-axis angular rates p m , q m , and 
r m , and the surface deflections 6 mi are perturbed quantities relative to the operating point, 
or trim values. Effects of the trim values are contained in the constants C XQ , Cy 0 , and C ZQ - 
Predicted, or estimated, values of the forces can now be computed by using equations (47) 
and (48), and the following residuals can be formed for the linear accelerations: 


v x = Ki x — Xjm' 
v y = A%n y - Yjm > 
vz = A c mz - Z/m J 


(49) 
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The last three equations of equations (44) can be rearranged as follows, neglecting cross 
products of inertia: 


P = j-L + ■ — QR 

1 h- It 

q= M+ — - RP 

h h 


r=L N + — — PQ 


(50) 


For the purpose of forming residuals, predicted values of the right-hand sides of equations (50) 
can be obtained by using measured quantities for the angular rates P, Q , and R and by using 
estimates of the moments L, M, and N as with the previous forces. In particular, let the 
moments be expressed as 


L = qSbCg 1 
M — qScCfji > 
N = qSbCn , 


(51) 


Now approximate the coefficients Q as the linear terms of a Taylor series expansion as follows: 


C( ” Q 0 + + 2y~~ (Ce p Pm + ^ 

■^0 r 




Cm — C m o + C ma a c m + —— C mQ Qm + C m c . <5 m • 

2V To Y 

C n = Cjiq + Cnp Pm + {Cn p Pm + Cn r T m ) + ^2 Cn 6 l 

i 0 i 


(52) 


As in equations (48), the air-data variables, the body-axis angular rates, and the surface 
deflections are perturbed values relative to the operating point. Equations (50), (51), and 
(52) can now be combined to obtain predicted values for the angular accelerations as follows: 


P^}-L + I y-J±Q mRm ' 

*x *x 

- 1 _ I z - It 

Q = —M - f r R m Pm > 

l y l y 

^ = ijv + ^ll '-PmQm 

*z *z 


(53) 


These predicted quantities could now be compared with the measured values P m , Qm , and R m 
of the angular accelerations if they were available; however, angular accelerations normally are 
not measured. Therefore, residuals are formed by comparing the predicted change in angular 
rate in one sample period with the change obtained from differencing successive measurements 
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of angular rate. Let 

AP(k) = ^[P(k) + P(k-l)}' 

AQ(fc) = y[5(*) + 5(*-1)] > (54) 

A R(k) = [h(k) + k(k - 1)] ^ 

Also, let . 

AP m {k) = P m (k) - P m {k - 1) 1 

AQ m (k) = Qm(k) - Qm(k - 1) \ (55) 

Ai?77i(fc) = Rm{k) Rm{k 1 ) J 

The residuals can now be formed as follows: 

vp{k) = A P m {k) - A P(k) ' 

u Q (k) = A Q m (k) - A Q(k) i (56) 

v R (k) = A R m (k) - A R{k) j 

In equations (48), (52), (53), and (55), measured values of the attitude rates are used. 
Although perturbed values of these rates are used in equations (48) and (52), these will usually 
be the same as the total values, since the attitude rates are normally zero at trim. The angles 
of attack and sideslip in equations (48) and (52) are perturbed, measured quantities that have 
compensated for lever-arm effects if the a and 0 sensors are not at the center of gravity; that 

is, . 

<*m = a m + lx {Qm/V Tm ) ~ h (An/^T™) ~ a 0 1 ^ 

0m ~ Pm~ f-x ( Rm/Vr m ) + ?z ( Pm/V^ ) - 0Q J 

Also, the accelerations in equations (46) and (49) are measured quantities that include 

compensation for a location other than the center of gravity; that is, 

= A mx ~ j-^r + Qm) + k / ( PmQm ~ Rm) + ?z ( P m Rm + Qm)] 

Am y ~ Amy ~ [lx ^ PmQm + Rm) ~ l\ y (^ P m 4" P rn) 4" lz ^ RmQm ~ An)] * 

A% lz = A mz - JV X ( RmPm - Qm) 4- iy {RmQm 4- An) - ( Qm 4" Am)] ^ 

The residuals from equations (49) and (56) form a six-dimensional vector sequence of residuals 
u[k) as follows: 

r^wi r ■*<*)! 


Also, let 


u{k) = 


v 2{k) Vy(k) 


v±{k) vp{k) 

^5 (k) u Q( k ) 

.*$(*)! Ufl( fc ). 
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To see what happens to the residual v(k) in the event of a failure, consider the first component 
Vx(k) when a portion of the jth control surface is lost at time k = kr. Prom equations (47), 
(48), and (49) 


"*(*) = Kn, ~ £ = ~ ~C X 

m, x m 


— a c - 

— ^m x 


-qS 


m 


C X q + C Xa a^ n {k ) + — C Xq qm{k ) + ^ Cx i .Sm i (k) 


To 


(60) 


As shown by Weiss (ref. 25), the aerodynamic coefficients can be expressed in terms of elements 
of the A and B matrices. Equation (60) can then be written as 


v x {k) = A 


m. 


qS 


m 


C Xo — [-An Wo + (Qo + A 12 ) C/g] Qj n (k ) 


- (Wq + Ai 3 )q m (k) -^2B u 6 mi (k) (61) 

i 

If there were no noise, no model errors, and no failures, then v x {k) would be zero. Suppose that 
at k = k j , a portion of control surface j is lost, such that a fraction e of its effectiveness is lost. 
Then the residual is described by - 


v x (k) = B^eSm^k) (k>k f ) (62) 

Similar results hold for the other components of the residual vector, so that u{k) can be expressed 
as 

v{k) = BjeSmj = Bjf s = s (k > kj) (63) 

where B j is the jth column of the B matrix, and f s is the effective failure magnitude. 


Design model. In a realistic system, there is sensor noise and quantization noise, and there 
are errors due to modeling inaccuracies; these add a random component n (k) to the residual 
sequence v(k). When a failure of the fth surface has occurred, a time- varying component 
Bifs(k) results from the failure; this component is the signal that must be detected to detect 
a failure. As in the actuator-path subsystem, it is assumed for design purposes that this time 
variation is slow compared with the detection time of 0.5 to 2 sec. Furthermore, it is assumed 
that the random component is a zero-mean, white Gaussian vector sequence with uncorrelated 
components. The design model u{k) of the residual is then 


H i '■ " d ( k ) = s * + n «>(fc) | 
H 0 : t 'd( k ) = n w(k) J 


(64) 


where s t is the failure signal and n w (k) is white Gaussian noise. The conditional probability 
density functions for u^{k) are 


H i: p(u d (k)\Hi) (27r)3[det(Eu;)] l/2 exp { 2 [ud[k) s i] T ^w l Wdi k ) szl} 

pMk)m = “p J 


(65) 
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where the covariance matrix T, w of n w (k) is diagonal. The decision process is structured 
according to this design model. 


Truth model As in the case of the actuator-path subsystem, the truth model for the residuals 
used in determining the parameters of the decision process includes a low-frequency noise 
term ng^k) to account for sensor biases and other model errors. As noted previously, the 
decision process assumes that the random component of the residual is white. Therefore, a 
high-pass whitening prefilter is used between the residual generator and the decision algorithm 
to decorrelate the residual noise. The filter cutoff frequency is chosen to be less than the inverse 
of the detection time to preserve the coherence of the signal. The truth model for the residuals 
then becomes 


Hf. v t (k) = s ih + n eh (k) + n wh {k) 
Hq ■ v t (k) = n ek (k) + n wh (k) 


( 66 ) 


where the subscript h denotes the quantity after high-pass filtering and X^ is the variance of 
the low-frequency noise n g{k) before high-pass filtering; X^ is assumed to be diagonal. 

To improve detection performance, the decision process again utilizes a signal S(JV) that is 
the sum of the residuals over N samples; that is, 


N 


s (N) = ]T ut(k) 
k = 1 


(67) 


The covariance Xy* of S (N) can be approximated as Xy* = N^'Hg + NH W . Since Xy is diagonal, 
each element o of Xy can be determined separately. Express each component of the noise 
vector n(k) — ng^(k) J rn w ^ l (k) in state space as the output of a linear system, as was done with 
the scalar noise n(k) in the actuator path, and then solve the Lyapunov equation. 


Trigger tests. Based on the design model, the trigger test for the ith surface must decide 
whether a constant vector signal s.j is present (hypothesis Hj) or not (hypothesis Hq), where 
the signal is corrupted by additive white Gaussian noise. The resulting trigger test for the zth 
failure in the aircraft path, as with the actuator path, is based on computing the log likelihood 
ratio Aj'.(k) of a window of the most recent iVj> residuals. That ratio is 


A T t ( k )= ^2 {*[' E w 1 v{j)- isfEu/sjj (68) 

j=k-N T +l 1 ' 

An equivalent statistic is 

k 

%(*)= £ Pf^i) < 69 ) 

j—k-Nj '- hi 


where the projection vector is used to produce a scalar metric for the test, and the residuals 
are computed as in equations (49), (56), and (59). Since the i/(fc)’s are independent, Sj\(&) is 
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Gaussian with conditional means and variance as follows: 


E{s T .(k)\Hi} = N T Pfs 
E{s r .(fc)|tf 0 } = 0 
var = var (s T .(k)\H 0 ^ = a\ = N t pJ 


i 


( 70 ) 




(71) 


The trigger test becomes 

then H\ 

< £j\, then Hq 

where the threshold £j\ is determined as in the actuator-path subsystem. First, for the design 
model, the probability of false alarm is given by equation (25). In equation (26), K a is chosen 
to achieve the desired false-alarm rate. The number of samples Nj> to use in the tests is chosen 
to minimize the trigger time while maintaining reliable tests. If any of these tests pass (Hi 
accepted), a trigger flag Fj'. is set to TRUE. 

Now that the basic structure of the trigger test has been chosen, the whitening prefilter is 
inserted. To choose the threshold, consider the test statistic Sj^.(k) under the truth model. 
Equations (5) to (21), (66), and (67) are used to compute the variance T, j of the sum of Nj> 
residuals by using the truth model as previously described. The conditional means and variance 
of the test statistic are 


E{s T .(k)\H i }^N T PjB i f s 

E{s Ti (k)\H 0 }=0 


var 




(72) 


( 5 T t ( fc )) = 4 Ti 

n 

The variance is then used in equation (26) to determine the threshold tj*. as was done 
previously for the actuator-path trigger test. 

The remaining step in the design of the trigger test is the computation of the projection 
vector P^. The projection vector is chosen to optimize the d 2 metric for the test statistic 
Sj^.(k); the signal-to-noise ratio for the given values of the failure signal = B if s and noise 
Ey is thus maximized, and the probabilities of detection and false alarm are improved. For the 
truth model 

1 2 




p i S /P* 


(73) 


from equations (36) and (72). Weiss (ref. 25) has shown that d 2 is maximized by choosing 
such that 

Pi = KVf Bifs (74) 

where K is any scalar constant. Normally, K is chosen to normalize the projection vector to 
unity magnitude, such that Pj becomes 


P i = 




( E 


n 1/2 


/ 


(75) 
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The minimum signal magnitude f Si required to achieve the desired value (2 K a )^ of d? can now 
be computed from equations (72) and (73) as follows: 

7 s , = (2A-„ ffSTi )/(jV T pfB j ) (76) 

In quest of robustness to modeling errors, the projection vectors are examined to determine 
if any components can be eliminated (set to zero). The criteria are as follows: eliminate the jth 
component of and recompute <Tg^ , and f Si > If fs t changes insignificantly (e.g., less than 

5 percent) from its previous value, then the jth component of is set to zero, and modeling 
errors in the corresponding component of the residual are not reflected into the test statistic. 
Otherwise it is restored to its original value. This procedure is repeated for each component of 
the projection vector. To account for the unknown sign of /s, the absolute value of Sj\ (k) is 
taken before comparing it with the threshold. With this addition, the design of the trigger test 
is complete, and the final test is shown in figure 9. 



Trigger 




Figure 9. Aircraft-path trigger test. 


Verify tests . The verify tests in the aircraft path are SPRT’s similar to those in the actuator 
path. The difference is that, since the aircraft-path residual sequence u{k) is a vector sequence, 
a projection vector P^ must be incorporated, as in the trigger tests, and this vector results in 
the verify test shown in figure 10. Before proceeding with the design, note that when using the 
truth model, the statistics of Sy.(k) are 


E {%.(*)!#*} = kG a pJbJ s - kG D 
E{s v .(k)\H 0 } = -kG D > 

var [s v .(k)] = = G\ PfS/WP, ^ 


(77) 



Figure 10. Aircraft-path verify test. 

After the maximum test length Ny is selected, the projection vector is chosen to maximize the 
d 2 metric at the end of the maximal length test ( k — Ny). 
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(78) 


d 2 (sVj ( N v)) 


(/V^pfBi/,) 2 

PfS f (N v )P, 


As with the trigger test, the result is that is given by equation (74) as 


P z = KHJ 1 (N v )B i f a 


If Ny = N'T, then the projection vectors for the verify tests are identical to those in the trigger 
tests. 

The remaining parameters (G A . , Gq., and ty.) are chosen by using the following four-step 
procedure described for the actuator-verify tests: 

1. Determine what value of the failure signal f Si produces a verify test at sample Ny that 
is reliable according to the d 2 metric; that is, 


p r B * 

*■ i i 


il»i = [2 KaVSy. W] / (N V G A ) 


= 2 Kn 


(Ny ) Pj] 1/2 j Ny 


(79) 


where 2 K a is the desired value of d. 
2. Let 


°A, 'PfB,/,, =5, 

G A = ( PrB , 7»,) 2 / 2 = »?/2 


( 80 ) 


3. Determine the value k of k for which the d 2 metric equals or exceeds 2 In [(1 - P E ) jP E ]; 
that is, solve the following for kf .: 


rf2 (%, (**,)) = [^PfB*,] / [pjs f (k t .) P,] 

> 2 In [(1 - P E ) jP E ] 

4. Set the threshold ty. equal to the mean value of Sy. (k^) a s follows: 


‘v, =E{s Vi (k t , )|H,} = 


h*i 


»2 


(81) 


(82) 


Whenever the ith verify-test statistic exceeds this threshold, the ith verify flag Fy. is set to 
TRUE (1). If the test statistic becomes less than -ty, Fy is set to FALSE (0). Otherwise, Fy 
remains undecided (2). This completes the design of the verify tests. 

Isolate tests. The purpose of the isolate tests is to help decide which surface failed when a 
trigger test and a verify test have passed. The isolate tests are initiated by the trigger tests 
and operate in parallel with the verify tests. The isolate tests are designed to decide between 
two hypotheses, H t and Hj, which represent failures in the ith and j'th surfaces, respectively. 
In reality, of course, both of these may be false. Ambiguities that result from these tests are 
resolved by a subsequent algorithm. 
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As a design model, assume that the residual vector sequence v(k) is composed of either of 
two constants B ; f s or Bj/s, plus additive white Gaussian noise n-«. ( A') : 


1 


Hi- v d( k ) = B ifs + n w( k ) | 
Hj : u d (k) = B jf s + n w {k) 

The conditional probability density functions for v d [k) are 

Hi- PM k )\ H i) = 


(2^) 6 / 2 [det (Em)] 1 / 2 
x exp Wd( k ) ~ B ifs] T ^w l Wd( k ) ~ 

„ d (k) - B J / S ] T E - 1 [» rI (k) - B jf a ] | j 


x exp < — 


( 83 ) 


( 84 ) 


where the covariance matrix 'Eyj of n w (k) is diagonal. 

One test for deciding between H t and Hj is the sequential probability ratio test shown in 
figure 11 and described by 


Sl lfj {k-k T + 1) 


S-y J (k — kj' + 1) 


S 7i (k - k T + 1) 


k 


k 

£ X j( m ) 

- 

Y2 7i M 

m~kj 


m—kj 


( 85 ) 


If Sj./.(k - k T - 1) > then decide Hj { F I l/3 = o) 

If - tj < Sj xj . (k - k T + 1) < tj./., then take another sample [ F r t/j = 2 ) 

If Sj (k-k T - 1) < -tj.,., then decide H t ( Fj . f . = l) 

where fcy is the trigger time. The absolute values have been used because the signs of the failure 
signals B t f s and B jf s are unknown. As with the verify tests, a maximum test length Nj is 
selected. The other parameters of the test (Pj/j. Pj/i> an< 4 A/^) are chosen using the truth 
model. The random component of the residuals in the truth model is the same as that used in 
the aircraft-path verify tests. The signals, or mean values, under the two hypotheses are the 
same as in the design model discussed previously. 

With this truth model and this test structure, and if the absolute-value functions are 
neglected, the relevant statistics for the isolate test are (where k is the number of samples 
from trigger time to simplify notation) 


E{s ll (k)\H l }=kPj /j B i f s y 

£{<? 7 t( k)\Hj}=0 


( 86 ) 
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Isolate 
i versus j 



Figure 11. Aircraft-path isolation test. 


var = P^E / (t)p. /j . 

(87) 

9 , * 2 ( P W B i) 2 /» 

<i 2 S-,,rt) = ± 11 ' 

p w E /W p « 

(88) 

E {St./.mHi} = | 

(89) 

”S, ~ var H j\ 


= ( P . r «- P J/.) E /( P W- P i/0 



(90) 

d 2 (Sr (t)) ~ >:1 ^ P * A,B ' + Pj/,B ') 

Vh/jW) - pT j m p , p T y. mp , 

(91) 


The following procedure, which is similar to that used for the verify tests, is used to choose the 
parameters for the isolate tests: 

1. Choose the projection operator P ^ to maximize the sensitivity of the test to the zth 
failure while making it minimally sensitive to the yth failure. This is done by selecting 
P i/j to maximize d 2 (S 7i (TV/)), subject to the constraint 

Pf/jBj = 0 (92) 

Weiss (ref. 25) has shown that the solution is given by 

where K is chosen to normalize to unit length; P-^ is similarly computed. 
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2. 


Determine the minimum failure-signal amplitude f S y } that produces the desired value of 
d 2 (Sj./. (Nj)j for the maximal length test (eq. (91)): 


yj 

S i/j ~ N r 


(94) 


A/i = W ( p f/i B ') 1 (95) 

Art = s ‘/i/ ( p i/* B i) ^ 

3. Determine the threshold ij by setting it equal to the expected value of the test 

statistic at the same stage (sample number) k t . f . in the test at which the d 2 metric 
is 2 In [(1 - Pe)/ p e\’ P E is the desired minimum probability of error in the test. This is 
done by using the minimum signal amplitude s. L / j from step 2 and solving 

*/f >2 1nl(l-P E )/P E l (96) 

a S,, {k) 

*/j 

for the minimum value kr ... of k that satisfies equation (96). Then, the threshold tj is 

l/J 

given by 

% s = e [A/, {%]) i B *i 

= V« p f/i B <A« < 97 > 

4. As with the trigger-verify projection vectors, examine each component of the Pj/j to 
determine whether that component can be eliminated without severely affecting nominal 
performance. The criterion is as follows: eliminate the mth components of Pj/j and Pj/j 
by eliminating the mth components of Bj and Bj and recomputing Pj/j and Pj/j by 
using equation (93). Recompute J Si /j and /, Sj y r If 7s t /j + 7sj/, changes insignificantly 
(e.g., less than 5 percent) from its previous value, use the new values of Pj/j and P j/j 
with zero mth components. Otherwise, return to the previous vectors Pj/j and Pj7j- 
This procedure is repeated for each component of the projection vectors. New thresholds 
tj are then computed by using equation (97) and thus completing the design of the 

HU 

isolation tests. 

Ambiguity resolution. The isolation test is performed for each pair of potential failures, and 
the result of each test is a decision that the ith failure is more likely than the jth, that the jth 
failure is more likely than the fth, or that more data are needed (take another sample). For an 
aircraft with n actuators, there are n(n — l)/2 of these decisions. Further processing is required 
to isolate the failure to a particular surface, if possible, based on the results of these pairwise 
decisions. 

During the FDI process, several flags are set. As previously noted, the trigger flag F T , verify 
flags F v ., and isolate flags Fj are set by the trigger, verify, and isolate tests, respectively. On 
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succeeding samples, if a flag is undecided, the test is performed again. Once a verify or isolate 
decision is made and the corresponding flag is set to 1 or 0, that test is not repeated and the 
flag is not changed unless a false trigger is declared. The flags are then reinitialized, and the 
FDI process restarts. 

During the ambiguity resolution process a failure flag F F is set to TRUE to indicate that an 
aircraft-path failure has been detected and isolated, and a confusion flag F c is set to TRUE to 
indicate that the isolation process has not isolated the failure to a particular surface but only 
to a group of surfaces called the confusion set. 

Because stabilizer and elevator failure effects are so similar, the FDI system cannot distin- 
guish between these failures. Therefore, the system attempts to isolate a failure in one of these 
surfaces only to the left horizontal tail or the right horizontal tail. In this case, the confusion 
flag is set to TRUE, and the confusion set is compiled. Once an aircraft-path failure has been 
isolated, including isolation to the left or right horizontal tail, the aircraft-path subsystem ceases 
to process data. (The current FDI system cannot accommodate multiple aircraft-path failures.) 
In some cases, results of the verify and isolate tests lead to detection of a failure that cannot be 
isolated. In these cases, an undetermined aircraft-path failure is declared, the confusion flag is 
set to TRUE, and the confusion set is compiled. However, the false-trigger flag is set to TRUE, 
and on the next sample the system reinitializes the flags and continues to search for a failure. 

The ambiguity resolution procedure is illustrated in flowchart form in figure 12. The salient 
features of the procedure are as follows: 

1. If all verify tests fail, a false trigger is declared and the FDI process is reinitialized 

2. If the verify test for the zth surface passes and all pairwise isolation tests pass in favor of 
the ith surface, the ith surface is declared failed; if this surface is either the left or right 
horizontal tail, the confusion flag is set and the confusion set is compiled 

3. If each of the surfaces satisfies one of the following: 

a. The verify test fails 

b. The verify test is undecided and the surface fails all of its pairwise isolation tests 

c. The verify test passes and there are no undecided isolation tests for this surface 

then an undetermined failure is declared, the confusion flag is set to TRUE, and a 
confusion set is compiled that consists of the potential failed surfaces; if the confusion 
set is empty, a false trigger is declared, and the aircraft path is reinitialized to continue 
processing 

4. Otherwise, another sample is taken, and the process continues 

Design Results 

Using the methodology described in the section “Design Concept,” a baseline FDI system 
was designed (ref. 25) for the modified 737 aircraft for subsequent evaluation via nonlinear 
simulation. This section contains the results of this design process for the baseline design. 

Actuator-Path Subsystem 

Application of the design methodology requires knowledge of the parameters for the actuator 
models. Values used in the baseline design for the actuator dynamics, namely cutoff frequency, 
position limits, rate limits, and cable stretch factor, are shown in table 2. Some engine pa- 
rameters are not shown since, as previously noted, the model used for the engines is more 
complicated than the generic first-order system with position and rate limits used for the other 
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Figure 12. Aircraft-path subsystem logic flowchart. 
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Figure 12. Concluded. 
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Table 2. Actuator-Model Parameter Values 


Surface 

Cutoff 
frequency, 
u ay rad/sec 

Position limits, 
deg 

Rate limits, 
deg/sec 

Stretch 

factor 

HPF cutoff 
frequency, 
rad /sec 

Thrust 

(a) 

6 1.54 

''13.77 

(°) 

0 

0.1 

31 

Stabilizers 

1.5 

-14 

3 

±10 

0 



Rudder 

22 

-10.3 

10.3 

±18 

0 



Elevators 

22 

-10 

10 

±20 

.0023 



Ailerons 

20 

-20 

20 

±20 

.0016 


' 


“Throttle-EPR-thrust relationship in actuator model is nonlinear. 
''Thrust in lb xlO 3 , corresponds to limits of 0° and 40° on throttle. 


actuators. Values for the noise, or error, terms in the model are shown in table 3. The low- 
frequency error terms were determined by the following procedure. The nonlinear simulation 
(described subsequently) was run for doublet maneuvers in roll, pitch, and sideslip. For each 
actuator, the residuals u{k) that resulted from comparison of the measurement of surface 
position with the position predicted by the actuator model were examined, and the maximum 
error (residual) magnitudes were determined. These worst-case errors E wc were assumed to 
approximate the three-standard-deviation (3 a t ) values for the low-frequency noise. The values 
for the white noise a w were twice the standard deviation of the white noise assumed for the 
sensors that measure the actuator positions. These values were then used to design trigger and 
verify tests for each actuator. 


Table 3. Errors for Actuator-Path Truth Model 


Actuator 

Thrust 

Stabilizers 

Rudder 

Elevators 

Ailerons 


Standard deviation 
of white noise, 
deg 


a 0.02 

.2 

.2 

.2 

.2 


Worst-case 
low-frequency 
noise, E wc , deg 


G 1.5 

.5 

3.0 

.75 

.50 


Standard deviation 
of low-frequency 
noise, <7£, deg 

a 0.5 

.167 

1.0 

.25 

.167 


“Thrust in lb xlO 3 . 

One-half second was selected as the window of samples for the fixed-sample trigger test, 
and similarly one-half second was chosen as the maximum time for the verify SPRT. At 
20 samples/sec, this window corresponds to 10 samples for and Ny. The low-frequency 
cutoff for the high-pass filters was selected to be 0.01 rad/sec. 

Trigger tests. To determine the trigger thresholds using equation (26), we need to know the 
factor K a that corresponds to the desired probability of error and a Sr , the standard deviation of 
the trigger-test statistic. It was assumed that the low-frequency noise in the residuals was nearly 
constant over the 0.5-sec trigger-test window. The variance of S? was then approximated as 
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< ’ S ^‘ 7 ' + VW (") 

A probability of error of 2.7 x 10 ^ corresponds to Kq- — 3. These values were then used to 
calculate the trigger thresholds according to equation (26), or 

t T = K(x(7 St 

Results are listed in table 4. Equation (26) produced a threshold of 3.1° for the rudder. However, 
because of a problem with false alarms in the rudder test during simulation, the threshold was 
increased to 4.1° for the baseline design. 


Table 4. Baseline-Design Results for Actuator- Path Subsystem 


Surface 

N t 

tT, deg 

N v 

tv, deg 

s, deg 

Ga 

G d 

Thrust 

10 

“1.6 

10 

“7.5 

“3.0 

1.0 

1.5 

Stabilizers 



.6 



2.5 

1.0 



.5 

Rudder 



4.1 



20 

6.0 



3.0 

Elevators 



.85 



3.75 

1.5 



.75 

Ailerons 



.6 



2.5 

1.0 



.5 


“Thrust in lb xlO 3 . 


Verify tests. The first step in the design of the verify test is to determine the minimally 
detectable signal s by using equation (40) as follows: 


d 2 (Ny) = 


2 s2 


NyS 


s v 


(Ny) 


= (2 K a f 


The number of samples has been chosen to be 10, and K& = 3 as in the trigger test. The 
variance of the verify statistic is approximated as 


r s v ( N v) 


N, 


2 

V a t 


Therefore, 


s — 2K(j<j£ — 2 E^ 


wc 


( 100 ) 


( 101 ) 


With this approximation for the variance of Sj-, the minimally detectable signal s and the 
metric d are independent of Ny (and k ) . The gains G\ and Gjy can now be determined 
from equations (41). The next step in the design is to determine the value k t at which 
d ( Sy(k t )) > 2 In [(1 - P E ) / P E \. Since d? is independent of k, this step is omitted, and 
the verify threshold is set equal to the expected value of the verify statistic at sample Ny/2 as 


follows: 


t v = E {SV (AV/2)} = ^ = 5 E wc 


( 102 ) 




Results are shown in table 4. Because of the false-alarm problems with the rudder, the 
computed value of 15.0 for the rudder-verify threshold was increased to 20.0 for the baseline 
design. 


Aircraft-Path Subsystem 

Design of the aircraft-path subsystem requires that the variances and of the white 
and low-frequency errors in the truth model of the residuals (eqs. (66)) be determined. In this 
case, the residuals and, thus, the error terms are six-component vectors, but the covariance 
matrices are assumed to be diagonal. 

The white-noise term is produced by the noise on the various sensor outputs and propagated 
into the residuals in the following manner. Consider, for example, the x-acceleration component 
i/ x (k) of the residuals. From equations (60) and (61), 

J'x(fc) = A m x -X/m 

Cx o + C Xa a c m (fc) + CxqQm{k) ^ ^ (^) 

^0 i 

= A ^ — — Cxq ~ [-A U W 0 4- (Qq + A 12 ) Uq] ot m (k) 
x m 

— [Wq + ^ 13 ] Qm(k) — (k) 

i 

= A m x ( k ) ~ ~Cx 0 - C x } ^mj{ k ) ( 103 ) 

j 

where the C r ’s are the dimensional stability and control derivatives listed in table 5, and the 
8 m (fc)’s are the measurements from the aircraft sensors. The variance a^ x of the white-noise 
component of the error in u x {k) can be determined from 





+£cj.„ 


j 


(104) 


Table 5. Dimensional Stability and Control Derivatives 


Force or 
moment 
axis 

Q, 

deg 

ft 

deg 

P, 

deg /sec 

9, 

deg /sec 

r, 

deg/sec 

Thrust, 
lb x 10 3 

Stabilizer, 

deg 

Rudder, 

deg 

Elevator, 

deg 

Aileron, 

deg 

Spoiler, 

deg 

x, ft/sec 2 

0.576 

0 

0 

0.000309 

0 

0.342 

0.0211 

0 

0.00989 

0.0113 

-0.0181 

i/, ft/sec 2 

0 

-.663 

.0131 

0 

.0372 

0 

0 

.202 

0 

±.00179 

±.0185 

z, ft/sec 2 

-3.60 

0 

0 

-.00355 

0 

-.00474 

-.248 

0 

-.116 

-.133 

.133 

P, rad/sec 2 

0 

-.0829 

-.0347 

0 

.0124 

±.0021 

±.0119 

.0147 

±.00556 

±.0118 

±.013 

<5, rad/sec 2 

-.0327 

0 

0 

-.0113 

0 

.00620 

-.036 

0 

-.0167 

-.00473 

.00197 

P, rad/sec 2 

0 

.0159 

.00267 

0 

-.00300 

±.0124 

±.000883 

-.0174 

±.000506 

±.000959 

±.002 


n t 

where cj'a T is the variance of the noise on the x-accelerometer output, and a j is the variance of 
the white noise on the jth measurement. The values for aj are the same as the values used in 
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the simulation. The other five diagonal terms of E w are computed in a similar manner, and the 
results are shown in table 6. 

A dominant component of the low-frequency error in the residuals is produced when errors 
in the aircraft model (the derivatives) are excited by aircraft motion and surface deflections. 
The magnitudes of the low-frequency errors can be estimated as shown in reference 25. One 
technique is to estimate the maximum error in the stability and control derivatives, estimate 
the variance of the measured parameters (such as angle of attack and surface deflections) that 
multiply these derivatives, and compute the variances of the low-frequency errors, much like the 
computation of the white-noise variances in equation (103). For the baseline design, however, 
the variance of the low-frequency error was determined another way, much like it was done for 
the actuator-path subsystem. The aircraft was flown in simulation in a climbing turn with no 
turbulence. Residuals v{k) were calculated, and the worst-case errors were determined. The 
error standard deviations Of were then set equal to two-thirds of the worst-case errors. The 
resulting values are shown in table 6. The cutoff frequency of the low-frequency error model 
was selected to be 2 rad/sec (ag = 0.905 in eq. (6)). The values of < 7 y (20) are the square roots 
of the diagonal terms of Ej-(N) for N = 20. 

The cutoff frequency of the high-pass filter was chosen to be 0.5 rad/sec. The window length 
for the trigger tests was chosen to be 1 sec, or 20 samples. The maximum length for the verify 
and isolate SPRT’s was similarly selected to be 20 samples. Using these data in the truth model, 
the Lyapunov equation was solved for each of the six components of the residual as previously 
described to compute the diagonal terms of Ey(20). Results are listed in table 6. 

Trigger tests. The projection vector Pj, which will operate upon the residuals v(k) in the 
trigger test for the ith surface, was computed from equation (75), and the resulting vectors 
are shown in table 7. The test statistic for the zth trigger test is given by equation (69). The 
variance cr^, of the test statistic was computed by using equation (72). By using equation (26) 

and a value of 3.1 for K a , which corresponds to a probability of error of 2 x 10 ^ , the thresholds 
for the trigger tests were computed, and the results are listed in table 7. For the test statistic, 
the software used in the simulation actually uses 


S Ti ( k ) = 


E pf-o) 


j—k—Nj+l 


k 


E 

j=k—Nx+l 


IpTp. 

2 * 1 


(105) 


Since E^S t .^HqJ = N T /2, the trigger thresholds actually used in the simulation were 
calculated using 

t Tl = K a a STi - ^ (106) 

The minimum value f Sl of the failure that will produce a reliable test at sample Nj- according 
to the d? metric was calculated from equation (76) with K a — 3.1. 

Each projection vector Pj was then examined to determine which components contributed 
significantly to the reliability of the detection process. Each of the six components of Pj were 
set to zero one at a time, and a new value for the minimum signal f Si was computed. If the ratio 
of the new value to the previous value was less than 1.05, the component of Pj being examined 
was kept at zero. Otherwise, it was restored to its original value. Using this procedure, new 
projection vectors were computed with new thresholds and new values for the minimal detectable 
failures. Results are shown in table 8. 
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Table 6. Errors for Aircraft-Path Truth Model 


Residual 

Standard 
deviation of 
white noise, 
a <r w 

Low-frequency 
noise cutoff, 
rad/sec 

Standard 
deviation of 
low-frequency 
noise, b <T( 

HPF 

cutoff 

frequency, 

rad/sec 

Standard 
deviation of 
total noise, 
c <r/(20) 

z-acceleration, v x 

0.39 ft /sec 2 

2.0 

0.20 ft /sec 2 

0.5 

2.94 ft /sec 2 

^-acceleration, v y 

.42 ft /sec 2 



.033 ft/sec 2 



1.74 ft/sec 2 

^-acceleration, v z 

1.50 ft /sec 2 



.20 ft /sec 2 



6.52 ft /sec 2 

P-acceleration, vp 

.035 rad/sec 2 



.020 rad/sec 2 



.286 rad/sec 2 

Q-acceleration, vq 

.017 rad/sec 2 



.0050 rad/sec 2 



.0925 rad /sec 2 

^-acceleration, vp 

.012 rad/sec 2 



.0034 rad/sec 2 



.0642 rad/sec 2 


“Square root of diagonal terms of 
^Square root of diagonal terms of E^. 
c Square root of diagonal terms of Ey\ 


Table 7. Baseline-Design Results for Aircraft-Path Trigger Test Before 
Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

P: 

( V x ) 

0.0127 

0.0127 

0.00055 

0.000577 

0 

0.00211 

0.00211 

K) 

(i'U 

0 

0 

0 

0 

.0158 

.000962 

.000962 

-.0000360 

-.0000360 

-.00138 

-.00138 

0 

-.00507 

-.00507 

i v p) 

.00828 

-.00828 

.0344 

-.0344 

.0424 

.233 

-.233 

("?) 

.234 

.234 

-.998 

-.998 

0 

-.896 

-.896 

(tv) 

.972 

-.972 

.0508 

-.0508 

-.9990 

.377 

-.377 

as T 

.0760 

.0760 

.0933 

.0933 

.0709 

.114 

.114 

tj 

-9.764 

-9.764 

-9.711 

-9.711 

-9.780 

-9.646 

-9.646 

f Sf 

1.32 

1.32 

.787 

.787 

1.04 

4.40 

4.40 


Verify tests. Since the maximum length of the verify SPRT is the same as the length of the 
trigger tests (Ny = iVy = 20), the projection vectors for the verify tests are the same as those 
for the trigger tests. The minimum value s, of the failure that produces a reliable test at sample 
Ny according to the metric was calculated from equation (79) by using K c r = 3.1. Since 
Ny = N t , and the same value of K a was used for the trigger and verify tests, the values of f Si 
are the same as the final values from the trigger tests (after the insignificant components of Pj 
were set to zero) . The gains G and G were then determined from equations (80) . Using 
p £ = lx 10~ 3 , the verify thresholds were then computed with equation (82) after determining 
k ti from equation (81). Results are shown in table 9. 

Isolate tests. The maximum length of the isolate SPRT’s was chosen to be 1 sec ( Nj = 20), 
and the projection vectors P.-^ were computed from equation (93). Minimum- failure signal 
amplitudes for reliable detection were computed from equations (94) and (95) by using K a = 3.1 
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Table 8. Baseline-Design Results for Aircraft-Path Trigger Test After 
Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

£ 

Qh 

0.0131 

0.0131 

0 

0 

0 

0 

0 

K) 

0 

0 

0 

0 

.0159 

0 

0 

(»z) 

0 

0 

0 

0 

0 

0 

0 

K) 

0 

0 

0 

0 

0 

.252 

-.252 

("<?) 

0 

0 

o 

1 — 1 
1 

-1.0 

0 

-.968 

-.968 


.9999 

-.9999 

0 

0 

-.9999 

0 

0 


.0749 

.0749 

.0925 

.0925 

.0699 

.115 

.115 

tj 

-9.768 

-9.768 

-9.713 

-9.713 

-9.783 

-9.644 

-9.644 

f S^f 

1.38 

1.38 

.796 

.796 

1.05 

4.72 

4.72 


Table 9. Baseline-Design Results for Aircraft-Path Verify Test After 
Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

$ 

0.0232 lb x 10 3 

0.0232 lb x 10 3 

0.0287° 

0.0287° 

0.0217° 

0.0356° 

0.0356° 

G a 

.0232 

.0232 

.0287 

.0287 

.0217 

.0356 

.0356 

G d 

.00027 

.00027 

.00041 

.00041 

.00023 

.00063 

.00063 

kr 

6 

6 

7 

7 

7 

6 

6 

t v 

.00162 

.00162 

.00288 

.00288 

.00164 

.00381 

.00381 


and Pj? = 1 x 10 3 . Thresholds for the isolate test were then computed by using equation (96) 

to find kj and equation (97) to find tr . 

yj ' ’ H/j 

As with the trigger-verify projection vectors, the isolate projection vectors P{/j were 
examined to set to zero any vector component that contributed insignificantly to the isolate 
process. In this case, a value of 1.2 was used as the test of significance for the ratio of minimum 

signal amplitudes {jijj + ^ 7 *) new / fa/* + fj/ij Results are listed in table 10. 

Baseline-Design Simulation Results 
Simulation Description 

The simulation used to evaluate the baseline FDI system was a six-degree-of-freedom 
nonlinear digital simulation of a transport airplane. The airplane model was a modified 737. 
The aerodynamics and controls were changed to allow for separate surface operation of the 
right and left ailerons, elevator, and stabilizer; that is, the right and left surfaces could be 
controlled individually. Also, the speed of response of the stabilizer was improved by modeling 
the actuator as a first-order system with a time constant of 1.5 sec. This change was made 
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so that the stabilizer would be a more useful redundant surface in the restructurable-controls 
studies. Position and rate limits were included in the model. 


Table 10. Baseline-Design Results for Aircraft-Path Isolate Test After 
Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 









(LT) 


0.176 

0.109 

0.109 

0.336 

0.110 

0.132 

( RT ) 



.109 

.109 

.336 

.132 

.110 

(LH) 




.387 

.113 

.306 

.306 

(RH) 





.113 

.306 

.306 

(Ru) 






.132 

.132 

(LA) 







.193 

(RA) 








*i/r 

(LT) 


0.0273 

0.0168 

0.0168 

0.0521 

0.0170 

0.0204 

(RT) 



.0168 

.0168 

.0521 

.0204 

.0170 

(LH) 




.0599 

.0175 

.0474 

.0474 

(RH) 





.0175 

.0474 

.0474 

(Ru) 






.0205 

.0205 

(LA) 







.0300 

(RA) 








k i/r 








(LT) 


6 

7 

7 

7 

7 

6 

(RT) 



7 

7 

7 

6 

7 

(LH) 




5 

7 

5 

5 

(RH) 





7 

5 

5 

(Ru) 






6 

6 

(LA) 







6 

(RA) 








tl i/f 








(LT) 


0.164 

0.118 

0.118 

0.365 

0.119 

0.123 

(RT) 



.118 

.118 

.365 

.123 

.119 

(LH) 




.300 

.122 

.237 

.237 

(RH) 





.122 

.237 

.237 

(Ru) 






.123 

.123 

(LA) 







.180 

(RA) 









The simulation included provisions for simulating failures in each of the controls: left throttle, 
right throttle, left stabilizer, right stabilizer, rudder, left elevator, right elevator, left aileron, 
and right aileron. Each surface could be failed to stick at its current position, to stick at a 
neutral (trim) position, to stick at hardover position, or to lose part of its effectiveness. In the 
neutral and hardover failures, the actuator command was set to the failed position at the time 
of failure, and this command was then propagated through the actuator dynamics to determine 
the surface position as a function of time. For the partial-surface loss, the command to the 
actuator was set at the time of failure to the commanded (desired) position multiplied by the 
percent effectiveness due to the failure. 
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The simulation included the capability to simulate atmospheric turbulence and steady-state 
winds. Turbulence was modeled according to the Dryden spectra. 

Aircraft sensors modeled in the simulation included attitude gyros, rate gyros, body-mounted 
accelerometers, an inertial navigation system, an air-data system, alpha and beta vanes, actuator 
position sensors, engine pressure ratio (EPR) sensors, and a microwave landing system. The 
models provided for white Gaussian noise, bias, scale factor, and alignment errors in the sensor 
measurements as appropriate. Sensor dynamics were not included. Values for the errors can be 
found in table 11. 


Table 11. Sensor Errors Used in Simulation 


Sensor 

White-noise 
error, la 

Bias error 

Scale-factor 

error 

Misalignment 

error 

Altitude gyros: 





$ 

0.23° 

-0.23° 

0 

0 

0 

.23° 

.23° 

0 

0 

$ 

.23° 

-.23° 

0 

0 

Attitude rates: 





P 

0.02 deg/sec 

0 

0 

0 

Q 

.02 deg/sec 

0 

0 

0 

R 

.02 deg/sec 

0 

0 

0 

Angle of attack, a 

0.4° 

0.25° 

0 

0 

Sideslip, (3 

0.4° 

0.25° 

0 

0 

Accelerometers: 






0.32 ft/sec 2 

0.32 ft/sec 2 

0.0025 

“0.2, -.2, .25 

a y 

.32 ft /sec 2 

.32 ft/sec 2 

.0025 

“.2, -.2, .25 

a z 

.32 ft /sec 2 

.32 ft/sec 2 

.0025 

“.2, -.2, .25 

True airspeed, V? 

2.5 ft/sec 

4.0 ft/sec 

0 

0 

Thrust 

0.01 lb x 10 3 

0.02 lb x 10 3 

0 

0 

Surface positions 

0.1° 

0.1° 

0 

0 


“Misalignment in degrees for $>, 0, and respectively. 


The control laws and the FDI algorithms implemented in the simulation were developed by 
Alphatech (refs. 25, 26, 37, and 38) in their restructurable-controls studies. This implementation 
was accomplished by integrating into the Langley simulation the software produced by Alphatech 
to simulate a restructurable flight control system. The control laws were the baseline linear 
quadratic (LQ) control system described in reference 38. Input commands to the control 
system to perform simulated maneuvers were perturbations in pitch 9, rr-velocity u, roll <p, and 
y- velocity v. The maneuver used for most of the evaluation runs was a climbing turn beginning 
at 10 sec into the run. This maneuver, denoted CT4 and illustrated in figure 13, consists of a 
15-sec bank right and a 34-sec pitch-up. Most runs lasted 60 sec, with failures at 5 sec. 

The FDI system was the baseline design described in the previous section. Values for the 
actuator subsystem design parameters were the same as those in reference 25, except for the 
rudder as previously noted. The aircraft-path subsystem design parameters were similar to, but 
slightly different than, those presented in reference 25. 
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Figure 13. Climbing-turn maneuver CT4. 


No- Turbulence Results 


Actuator-Path Subsystem 

The performance of the FDI system in detecting and isolating actuator-path failures under 
zero atmospheric turbulence conditions was evaluated by simulating three different types of 
failures for each of five actuators. These were single-point failures; that is, the failures occurred 
one at a time, and there was a separate simulation run for each failure. The three types of failures 
were current position — at the failure time, the failed actuator stuck at its last calculated position; 
neutral — at the failure time, the actuator was driven to its trim position through the actuator 
dynamics; and hardover— at the failure time, the actuator was driven to a hardover position 
through the actuator dynamics. Each failure occurred at t = 5 sec, and the climbing-turn 
maneuver was initiated at t = 10 sec. 

As can be seen from the results shown in table 12, all the failures were detected and 
correctly isolated; this was accomplished with only one false alarm. Except for the rudder, 
the current position and neutral failures were not detected until the maneuver began, because 
in nonmaneuvering flight in zero turbulence, there is little actuator activity. Also, the detection 
times for the current position and neutral failures are similar. Because of the small actuator 
excursions prior to the maneuver, the current position failures caused the actuator to be stuck 
in a position not far from neutral (trim). All current position and neutral failures except 
the throttle were detected and correctly isolated within 1 sec after maneuver initiation. The 
longer time needed to detect the throttle failure was due in large part to the slower change in 
commanded throttle position and the considerably slower throttle-thrust dynamic response. As 
would be expected, the hardover failures were detected much more quickly than the current 
position and neutral failures; all hardover failures except throttle were detected in less than 
0.5 sec. While the quicker detection of hardover failures was anticipated, it was also necessary, 
since a hardover failure can place the aircraft in danger more quickly. The one false alarm 
was a rudder false alarm in the aircraft-path subsystem; this false alarm occurred after the 
actuator-path subsystem had correctly detected a hardover rudder failure. 
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Table 12. Simulation Results for Actuator- Path Failures, No Turbulence 



Detection/isolation times, 0 sec 

Failed actuator position, ^ deg 

False alarms c 

Failure 

Current 

Neutral 

Hardover 

Current 

Neutral 

Hardover 

Current 

Neutral 

Hardover 

Right throttle 

12.60 


3.25 

-1.10 



0 

0 



0 

Right stabilizer 

6.00 

5.95 

.30 

-0.07 

0 

d - 14 



0 

0 

Rudder 

.70 

no 

.45 

-1.80 



10 





1 

Right elevator 

5.60 

5.60 

.25 

-0.44 



-10 





0 

Right aileron 

5.40 

5.50 

.25 

1.30 

> 


-10 

- 


> 


0 


°Verify time relative to failure time. 

^Relative to trim. 

includes both actuator-path and aircraft-path false alarms. 
^Absolute, not relative to trim. 


Illustrations of the data produced by the FDI actuator-path subsystem are shown in 
figures A1 and A2 in the appendix for a failure of the right aileron stuck at its current position 
at t = 5 sec. For each of the nine actuators, figure A1 contains plots of the commanded actuator 
position, the measured position, and the position estimated by the actuator model. Figure A1 
also contains plots of the residual for each actuator before and after high-pass filtering. Figure A2 
contains plots of the trigger statistic and the trigger threshold and plots of the verify statistic 
and verify thresholds for each actuator. For the convenience of the reader, those time histories 
pertaining to the right aileron are repeated in figure 14. At t = 5 sec the measured right-aileron 
position sticks at about 1.3° and the right-aileron residual increases at this point. The residual 
becomes much larger when the maneuver begins ( t = 10 sec). The squared-off appearance of the 
residual is the result of limiting in the plotting program to prevent the plot from going off scale. 
There is no noticeable change in the other actuator residuals as a result of the failure. Also, 
the right-aileron trigger statistic crosses its threshold at least three times, twice prior to the 
maneuver. It can be seen from the plot that, in response to the triggers before the maneuver, 
the verify statistic begins to accumulate but the time limit is exceeded before reaching either 
threshold. When the maneuver begins and the residuals are larger, the verify statistic crosses 
the threshold and correctly detects and isolates a right-aileron failure 0.1 sec after the trigger. 
The trigger and verify statistics are limited by the plotting program. There were no triggers in 
any of the other actuator tests. After the failure is detected and isolated (fig. 14), the control 
system continues to command the right aileron. A restructurable control system would at that 
point cease commanding the right aileron and distribute control among the remaining effectors. 

Aircraft- Path Subsystem 

The performance of the baseline FDI system in detecting and isolating aircraft-path failures 
under zero atmospheric turbulence conditions was evaluated by simulating a loss of surface 
effectiveness, or a partially missing surface, for each of the four types of surfaces: stabilizer, 
rudder, elevator, and aileron. Aircraft-path failures of the throttle-engine combination were not 
implemented in the simulation. These were single-point failures; that is, the failures occurred 
one at a time, and there was a separate simulation run for each failure. The aircraft-path 
subsystem was not designed to detect multiple failures. Each failure occurred at t = 5 sec, and 
the climbing-turn maneuver CT4 was initiated at t = 10 sec. 

Results of the simulation that demonstrates the performance of the aircraft-path subsystem 
are shown in table 13 as a function of the percent effectiveness of the failed surface. To a 
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Time, sec 

Figure 14. Right- aileron position, residual, trigger statistic, and verify statistic for stuck-at-current-position failure 
with no turbulence. 

first-order approximation the percent of the surface that is missing equals 100 minus the percent 
effectiveness. All four failures, right stabilizer, rudder, right elevator, and right aileron, were 
detected with the surface at 60-percent effectiveness. Failures of lesser effectiveness were not 
simulated, because they would be easier to detect and isolate. The stabilizer and rudder failures 
were detected in less than 2 sec, while the elevator and aileron failures were detected after 
the maneuver began. When the rudder was failed at 80-percent effectiveness, the failure was 
detected, but only after a delay of slightly more than 48 sec. Failures of the stabilizer, elevator, 
and aileron at 80 percent were not detected. As can be seen in table 13(b), all the failures 
at 60-percent effectiveness, except the right elevator, were isolated at least to a confusion set 
containing the failed surface. The isolation times were comparable with those with the actuator- 
path stuck- at-neut ral and stuck-at-current-position failures, but as expected, detection and 
isolation were not as quick as with the hardover failures. The stabilizer failure was isolated to 
a confusion set containing the failed surface, since the system was not designed to discriminate 
between stabilizer and elevator failures. When the elevator failed, it was not isolated, but an 
undetermined failure was declared with the confusion set containing the failed surface. Similarly, 
when the rudder was failed at 80-percent effectiveness, the failure was not isolated to the rudder, 
but an undetermined failure was declared with the confusion set containing the rudder and the 
left throttle. No false alarms were experienced in these simulation runs in either the aircraft- 
path or actuator-path subsystems. In fact, no actuator-path triggers were experienced during 
these runs. A run with no failures was also made, and no false alarms and only one false trigger 
were experienced (table 13(c)). 

To illustrate the type of data produced by the aircraft-path subsystem, figures A3 to A6 
contain time-history plots of data produced during a simulation run with a partial right-aileron 
failure — in particular, a reduction of the aileron effectiveness to 60 percent at t = 5 sec. 
Figure A3 shows how the aircraft responds to the failure at t = 5 sec and to the climbing- 
turn maneuver CT4 at t = 10 sec. Application of the commanded maneuver illustrated in 
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figure 13 produces the elevator, stabilizer, and aileron activity shown in figure A3; as a result, 
the aircraft pitches up and rolls right between t = 10 and t = 15 sec. Between 20 and 30 sec, 
the aircraft rolls back to where the wings are level, and between 40 and 45 sec it pitches back 
down. This maneuver results in a heading change of approximately 45° and an altitude increase 
of nearly 600 ft, as seen in figure A3. 


Table 13. Failure-Detection and Isolation Performance of Aircraft-Path Subsystem 

Baseline Design With No Turbulence 

(a) Detection performance 


Failed surface 

Failure-detection time® as a function of 
percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 




1.15 

b ND 

Rudder 




1.95 

48.20 

Right elevator 




7.05 

b ND 

Right aileron 




11.70 

b ND 


“Time of failure declaration relative to time of failure. 
& See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of 
percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 




a CS (RS,RE) 
Yes 

a U{LS,RS : RE) 

Yes 

a ND 

a U (LT,Ru) 
a ND 
a ND 


“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time,® sec 

1 

1 

1 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 


Figure A4 shows the measured and predicted linear and angular accelerations and the resid- 
uals, which are the differences between the measured and predicted values. The plots for the 
p channel are repeated in figure 15. Changes in the accelerations x, z , and p are noticeable 
during the maneuver. However, the measured and predicted values track well, so that the resid- 
uals, though noisy, do not change significantly as a result of the maneuver. Neither changes in 
the accelerations nor in the residuals at the time of the failure are obvious in the plots. The 
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Time, sec 


Figure 15. Residuals, trigger statistic, verify statistic, and isolate statistic for right-aileron partially missing surface 
failure (60-percent effectiveness). Baseline design; no turbulence. 
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Figure 15. Concluded. 
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projection vectors in table 8 show that the right-aileron trigger and verify tests only utilize the p 
and q residuals, Vp and v q , respectively. Residual errors are weighted sums of band-pass-filtered 
measurements and were not used in the designs evaluated in this report. 

Figure A5 contains plots of the trigger statistics and thresholds and the verify statistics 
and thresholds for each of the seven surfaces; the plots for the right aileron are also shown in 
figure 15. (The left stabilizer and elevator and the right stabilizer and elevator are combined into 
the fictitious left and right horizontal tails.) Because of the relatively small aircraft accelerations 
in the no-turbulence environment, there are no triggers before the maneuver begins, even though 
the failure has already occurred. (The apparent left-aileron trigger at about t = 1 sec is not 
a true trigger, because it occurs during the 4-sec initialization period, when the FDI system is 
inhibited.) The first trigger occurs at t = 11.35 sec in the right-aileron channel (fig. 15), but 
the time limit on the right-aileron verify test is exceeded without making a decision, and the 
other six surfaces verify negatively (no failure) (fig- A5). Additional triggers occur in the right 
aileron, right throttle, and left horizontal tail at t = 12.50, 13.70, and 15.35 sec, respectively, 
without a failure being declared. Finally, as a result of a right-aileron trigger at t = 16.40 sec, 
the right-aileron verify test passes, all right-aileron isolation tests pass, and a right-aileron 
failure is correctly declared at t = 16.70 sec (11.70 sec after the failure). The isolate statistics 
and thresholds are shown in figure A6 and in figure 15 for the right aileron. All the pairwise 
isolation tests involving the right aileron indicate a right-aileron failure. Figures A5 and A6 
show that, after the failure is declared, the trigger, verify, and isolate tests cease to function, 
because the aircraft-path subsystem is designed to detect only single-point failures. 

Results With Turbulence 

Actuator-Path Subsystem 

As done with no turbulence the performance of the FDI system in detecting and isolating 
actuator-path failures while flying in atmospheric turbulence was evaluated by simulating three 
different types of failures for each of five actuators. Again, the three types of failures were as 
follows; current position — at the failure time, the failed actuator stuck at its last calculated 
position; neutral — at the failure time, the actuator was driven to its trim position through the 
actuator dynamics; and hardover — at the failure time, the actuator was driven to a hardover 
position through the actuator dynamics. As in previous runs, each failure occurred at t — 5 sec, 
and the climbing- turn maneuver was initiated at t = 10 sec. 

As can be seen from the results shown in table 14, all the failures were detected and correctly 
isolated. In general, the current position and neutral failures were detected significantly faster 
than in the no-turbulence case because of the increased actuator activity due to the turbulence. 
In fact, all the failures except the right-throttle stuck-at-current-position failure were detected 
before the maneuver began, and 11 failures out of 14 were detected in 1 sec or less. The most 
significant result from these runs, however, was the occurrence of false alarms. There was one 
false alarm in the aircraft-path subsystem in each failure run. In each case, it was a false 
detection and isolation of a right-throttle failure soon after the actual failure occurred; the 
first trigger occurred before the actual failure. When the aircraft-path failure was isolated, the 
aircraft-path subsystem was inhibited, and no further aircraft-path false alarms were possible. 

Three 60-sec runs were made, with no failures, and different sample sequences were used for 
the turbulence in each run. In the three runs, there were a total of seven false alarms, all in the 
aircraft path. Since there were no actuator-path false alarms, these no- failure runs are discussed 
in the next subsection. 
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Table 14. Simulation Results for Actuator-Path Failures, 10-ft/sec Turbulence 


Failure 

Detection/isolation times, 0 sec 

Failed actuator position,^ deg 

False alarms c 

Current 

Neutral 

Hardover 

Current 

Neutral 

Hardover 

Current 

Neutral 

Hardover 

None^ 








d 

7 





Right throttle 

5.55 


4.40 

-5.6 



0 

i 



1 

Right stabilizer 

1.15 

1.00 

.35 

.32 

0 

e - 14 



1 



Rudder 

.70 

.80 

.95 

2.3 



10 







Right elevator 

.80 

.85 

.30 

.27 



-10 







Right aileron 

.25 

1.00 

.40 

1.3 



-10 



> 


> 



a Verify time relative to failure time. 

^Relative to trim. 

^Includes both actuator-path and aircraft-path false alarms. 

^Three simulation runs with different sample sequences for random noises and turbulence. 
e Absolute, not relative to trim. 


Figures A7 and A8 and figure 16 show the data produced by the FDI actuator-path sub- 
system for a failure of the right aileron stuck at its current position at t = 5 sec. Comparison of 
the plots in figure A7 with those in figure A1 reveals the increased actuator activity and increased 
noise on the residuals in the turbulence case, especially in the rudder channel. The residuals are 



0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 

Time, sec 


Figure 16. Right- aileron position, residual, trigger statistic, and verify statistic for stuck-at-current-position failure 
with 10-ft/sec turbulence. 

larger in the thrust and rudder channels than in the others because the rudder is more active 
than the other surfaces and because the thrust and rudder FDI model errors are larger than the 
others. The rudder model in the simulation contains hysteresis and nonlinear rate limits. The 
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FDI engine model, while more complex than the other FDI actuator models, is considerably 
simpler than the engine model in the simulation. In spite of the increased noise on the residuals, 
there are no false alarms in the actuator path, and there is only one false trigger, namely, a 
left-throttle trigger shortly after t = 10 sec. (See fig. A8.) As a result of this trigger, the left- 
thrust verify test is activated, and the time is exceeded without making a decision. Comparison 
of figure 16 with figure 14 shows that the right-aileron verify test passes much more quickly m 
the presence of turbulence. 

The ability of the actuator-path subsystem to correctly detect failures without false alarms 
indicates that this subsystem is performing as anticipated. Although the limited amount 
of testing via simulation to this point has not revealed any design deficiencies or any need 
for redesign of the actuator-path subsystem, operation in higher turbulence reveals some 
deficiencies, as shown subsequently. 


Aircraft- Path Subsystem 

As stated in the previous section, three simulation runs with no failures were made with 
10- ft /sec turbulence and with the aircraft performing the CT4 climbing-turn maneuver. Each 
run utilized a different sample sequence for the turbulence. As can be seen in table 15, in the 
three runs there were a total of 11 false triggers and 7 false alarms in the aircraft path. Two of 
these were right-throttle false failures, and five were classified as undetermined failures, which 
allowed the aircraft-path subsystem to continue functioning. To help separate turbulence and 
maneuver effects on the false-alarm performance, another run was made in 10-ft/sec turbulence 
with no failures and no maneuver. Two aircraft-path false alarms were experienced in this run, 
an undetermined failure and a right-throttle failure. One more no-failure run was made with 
the CT4 maneuver with less turbulence (4 ft/sec). One false alarm, an undetermined failure, 
occurred at t = 42.25 sec. There were seven false triggers at this lower level of turbulence, 
because the aircraft-path subsystem operated for a longer period of time. 


Table 15. False-Alarm Performance of Baseline Design With 10-ft/sec Turbulence 


Run 

1 

2 

3 

4 
c 5 


Random- 
sequence set 


Maneuver 


CT4 

CT4 

CT4 

None 

CT4 


Number of 
triggers 


Number of 
false alarms 


Isolated 

surface 


6 rt 

1.50 

6 U 

2.50 

6 rt, 6 u 

18.50 

b RT, b U 

6.95 

6 U 

56.00 


FDI active 
time, 0 sec 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
^See symbol list for definition. 
c 4-ft/sec turbulence. 


Figure A9 shows the measured and predicted accelerations and the residuals for the no-failure, 
no-maneuver run in 10-ft/sec turbulence, and figure A 10 shows the corresponding trigger and 
verify statistics. The accelerations are considerably larger and more volatile than those in 
figure A4 for the no-turbulence, CT4 maneuver case. Though differences in the residuals are 
not as obvious, the trigger statistics in figure A10 are significantly larger than those in figure A5 
for the no-turbulence case. In the first 11 sec of the run, there were six false triggers, two false 
verifies, one false undetermined failure declaration, and one false right-throttle failure isolation. 
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The level of false alarms observed in these runs is obviously unacceptable and indicates that 
the truth model for the trigger, verify, and isolate statistics does not account for all the noises, 
or errors, introduced by the actuator activity and aircraft motion caused by the turbulence. 
Some modification must be made to the design to allow the system to operate in atmospheric 
turbulence. 

Results With Model Errors 

Previous studies (refs. 15, 18, and 22) indicate that one of the biggest problems to be 
overcome in FDI systems is the degradation in FDI performance caused by errors in the model 
of the plant. As mentioned previously, a primary reason for selecting a decentralized design for 
the current FDI system was to improve the robustness to aircraft model errors. These errors can 
be caused by the simplicity of the model, by the errors in measuring the basic parameters such 
as the aerodynamic coefficients, by variation from component to component, and by departing 
from the flight condition for which the FDI system was designed. To evaluate the robustness 
of the system, model errors were introduced; a number of simulation runs were completed to 
evaluate system performance. The types of model errors and the simulation results are discussed 
in the next two subsections. 

Actuator-Path Subsystem 

Errors were introduced into the actuator-path subsystem by changing the cutoff frequency, 
rate limit, position limits, and stretch factor of each of the actuator models for the stabilizers, 
rudder, elevators, and ailerons. The amount of error was based on a percentage of the nominal 
value, and the percentages for two different cases are tabulated in table 16. No model errors 
were introduced into the aircraft-path subsystem in either of these cases. 


Table 16. Actuator-Path Model Errors 


Model parameter 

Model error, percent of nominal 

Case 1 

Case 2 

Left surfaces 

Right surfaces 
and rudder 

Left surfaces 

Right surfaces 
and rudder 

Cutoff frequency 

-10 

10 

-25 

25 

Rate limit 

-10 

10 

-25 

25 

Upper position limit 

5 

-5 

12.5 

-12.5 

Lower position limit 

-5 

5 

-12.5 

12.5 

Stretch factor 

-15 

15 

-37.5 

37.5 


Simulation runs were made to evaluate actuator-path subsystem performance with errors in 
the actuator models according to the two cases in table 16. Runs were made with no failures 
and with a right-stabilizer failure, a rudder failure, a right-elevator failure, and a right-aileron 
failure, all without turbulence. One no-failure run with 10-ft/sec turbulence was made for each 
of the model-error cases. The failures were identical to the stuck-at-current-position failures 
reported in table 12. 

Results of the 12 simulation runs are shown in table 17. The table shows that all the failures 
were detected and isolated for both cases of model errors. Comparison with table 12 shows that 
the detection-isolation times were equal to or less than those with no model error. For case 1, 
the case with the smaller model errors, there were no actuator-path false alarms. The one false 
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alarm for this case was the previously experienced aircraft-path subsystem right-throttle false 
failure in the run with atmospheric turbulence. For the larger model errors of case 2, however, 
the results were different. There were two false alarms in the actuator-path subsystem for each of 
the no-failure runs; these two false alarms were false failures of the left and right ailerons in both 
runs. Two false alarms were also experienced in each of the runs; these false alarms simulated a 
rudder failure, a right-elevator failure, and a right-aileron failure. Three false alarms occurred 
in the right-stabilizer-failure run. All the false alarms were either left-aileron, right-aileron, or 
right-elevator failures. From these data, it seems that failure detection in the actuator-path 
subsystem is not a problem with small or moderate model errors, and small model errors can be 
tolerated without false alarms. However, as would be expected, false alarms become a problem 
as the model errors increase. 


Table 17. Simulation Results for Actuator-Path Stuck-at-Current-Position Failures 
With No Turbulence and With Model Errors 


Failed 

surface 

Failed actuator 
position, 0 deg 

Model-error case 

1 

Model-error 

case 2 

Detection/ 
isolation 
tiniest sec 

False 

alarms 0 

Detection/ 
isolation 
times ,' b sec 

False 

alarms 0 

None 



0 


2 

None** 



C 1 


f 3 

Right stabilizer 

-0.07 

5.95 

0 

5.95 

3 

Rudder 

-1.80 

.70 



.70 

2 

Right elevator 

-.44 

5.60 



5.60 

2 

Right aileron 

1.30 

1.90 



1.90 

2 


a Relative to trim. 

^Verify time relative to failure time. 

includes both actuator-path and aircraft-path false alarms. 
rf With 10- ft /sec turbulence. 
e Aircraft-path right- throttle false alarm. 

■^Includes one aircraft-path right- throttle false alarm. 


Aircraft-Path Subsystem 

To evaluate aircraft-path subsystem performance with respect to errors in the aircraft model, 
errors were introduced into the aircraft-path subsystem model in two ways. The FDI system 
design is based on a linear aircraft model at a single operating point described in table 1, and 
results previously discussed have been produced with the aircraft operating at that point. The 
first method of introducing model errors was to fly the aircraft (in simulation) at operating 
points different from that in table 1. Obviously, this technique simulates the performance of 
the FDI system as the aircraft departs from the design point, as it would always do during any 
flight. The second method of incorporating model errors was to inject random errors into the 
values for the aerodynamic and control derivatives that are used in the aircraft-path subsystem. 
These errors simulate the inaccuracies in the knowledge of the aircraft parameters, even at the 
design operating point. These procedures and the results of the simulation are discussed in the 
following two subsections. 

Other operating points. When the aircraft was flown at trim case A (see table 18) and the 
climbing-turn maneuver CT4 was performed, there was one false trigger in the aircraft-path 
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subsystem, but no false alarms, as summarized in table 19. When this run was repeated with 
10-ft/sec turbulence, the same right-throttle false alarm occurred that was experienced in the 
nominal trim case. 


Table 18. Aircraft Operating Points for Evaluation of Effects of Aircraft-Path Model Errors 


Parameter 

Nominal 

trim 

Trim 
case A 

Trim 
case B 

Trim 
case C 

Altitude, ft 

3500 

5000 

1500 

20000 

Indicated airspeed, knots 

160 

175 

140 

325 

Flight-path angle, deg 

0 

0 

-3 

0 

Flaps, deg 

15 

15 

30 

0 

Landing gear 

Up 

Up 

Down 

Up 


Table 19. False-Alarm Performance of Aircraft-Path Subsystem at Off-Nominal Trim Points 


Run 

Trim 

case 

Turbulence, 

ft/sec 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, a sec 

1 

A 

None 

1 

0 


56.00 

2 

A 

10 

1 

1 

b RT 

.50 

3 

B 

None 

0 

0 


56.00 

4 

C 

None 

1 

c 4 

b LT, b RT, b RA 

.40 


a Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 

b See symbol list for definition. 

includes three actuator-path false alarms. 


When the aircraft was initialized at trim case B (final approach on a 3° glideslope) and the 
climbing-turn maneuver was flown, there were no false triggers. Eight simulation runs were 
then executed at trim case B, each with an aircraft- path failure, and the results are shown in 
table 20. All the failures were detected. At 60-percent effectiveness, detection was a little slower 
than at nominal trim for the rudder failure and a little faster for the elevator failure. Although 
all failures were detected, isolation was a little more difficult than at nominal trim. Of the 
four failures at 60-percent effectiveness, only the stabilizer failure was isolated, and that to a 
confusion set (right horizontal tail) containing the right stabilizer as expected. Undetermined 
failures were declared as a result of the other three failures. The resulting confusion set contained 
the failed surface, except for the aileron failure. For the failures at 40-percent effectiveness, the 
rudder and aileron failures were isolated to the correct surfaces, and the stabilizer and elevator 
failures were isolated to confusion sets that contained the failed surface. (The right-stabilizer 
failure was correctly isolated to the right horizontal tail.) 

The aircraft was then initialized at trim case C, which represented a cruise condition at an 
altitude of 20,000 ft. Obviously, this condition was a large departure from the nominal trim 
for which the system was designed. A false failure of the right aileron was declared by the 
aircraft-path subsystem less than 1 sec after the FDI system was activated. It was expected 
that false alarms would occur in this case because of the model errors produced by the large 
departure from the design point. 
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Table 20. Failure-Detection and Isolation Performance for Aircraft-Path Failures With 

No Turbulence and Trim Case B 


(a) Detection performance 


Failed surface 

Failure-detection time® as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



0.60 

1.15 


Rudder 



2.30 

8.70 


Right elevator 



6.95 

7.10 


Right aileron 



6.70 

7.40 



"Time of failure declaration relative to time of failure. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 



a CS(RS,RE) 

Yes 

a CS ( LS,RS , LE,RE) 
Yes 

a CS ( RS,RE ) 

a U{RT,Ru) 

a U (LS,RS, LE,RE) 
a U (LS,RS,LE,RE) 



°See symbol list for definition. 


Random errors. To evaluate the effect of uncertainties in the aircraft model at the design 
point on the performance of the aircraft-path subsystem, simulation runs were made at the 
nominal trim point with random errors added to the model parameters. The random errors 
were generated by using a sequence of zero-mean, unit-variance, Gaussian, random numbers 
that were then multiplied by the desired standard deviation of the error in the model parameter. 
If the resulting error exceeded three standard deviations, a new random error was generated for 
that parameter. The standard deviations of the errors for the various parameters in the model 
are tabulated in table 21 in terms of percent of the nominal value. These percentages were based 
on data in reference 39 and on parameter estimation experience at Langley Research Center. 

Three no-failure runs were made that simulated the CT4 maneuver with no turbulence. Each 
run utilized a different seed for the random-number generator, so that different random errors 
were added to the model parameters for each run. In the first run, there were two aircraft-path 
false alarms; one was an undetermined (not isolated) failure, and the other was a false failure 
of the left throttle. In the second run, there were five false triggers, but no verifies and, thus, 
no false alarms. In the third run, there was one false trigger, but no false alarms. These results 
axe summarized in table 22. 

Four additional runs, each with a different surface failed at 60-percent effectiveness, were 
made with random-error set C. As can be seen from table 22, the failure was detected in each 
case. The stabilizer failure was correctly isolated to the right horizontal tail, but the elevator 
failure was incorrectly isolated to the left horizontal tail. Comparisons with similar runs without 
model errors in table 13 show that the detection time was the same for the stabilizer failure, but 
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Table 21. Standard Deviations of Random Errors Added to Aerodynamic and Control 
Derivatives and to Other Model Parameters To Evaluate Model-Error Effects 


Parameter 

Standard 

deviation, 

percent 

Parameter 

Standard 

deviation, 

percent 

Parameter 

Standard 

deviation, 

percent 

c x Q 

10 


10 

<?Z Q 

5 

c x q 

30 

CV P 

50 

Cz q 

20 



cv r 

30 



^x bT 

5 

C Yit 

20 

c z tT 

5 

C X 6S 

10 

C YbS 

20 

C ZfS 

10 

C *m 

20 

C Ysr 

5 

C Z(R 

20 

C *6E 

10 


20 

C ZbE 

10 

C X„ A 

20 

C YfA 

20 

Cz tA . 

20 

^ X 6Sp 

10 

C YbSp 

20 

^ Z bSp 

10 

°Xo 

5 

CV 0 

5 


5 

c b 

10 

Cm Q 

5 

Cn, 

5 

c b 

10 

Cmq 

10 

Cnp 

90 

Clr 

40 



Cn T 

10 


20 

Cm 6T 

5 

Cn bT 

5 

C hs 

10 

Cm 6S 

5 

^n bS 

10 

C hR 

10 

Crn SR 

10 

Cn bR 

5 

C \e 

10 

Cm 6E 

5 

^n bE 

10 

C hA 

5 

Cm 6A 

10 

Cn bA 

10 

Cl 6Sp 

10 

Cm 6Sp 

10 

Cn bSp 

10 

Ci o 

5 

CrriQ 

5 

Cn, 

5 

lx 

1 

w 

1 

h 

1 

Mass 

0.5 





b 

0.5 

C 

0.5 

S 

0.5 


detection and isolation of the rudder failure took much longer in the presence of model errors. 
Detection and isolation of the aileron failure were somewhat faster with model errors, presumably 
because the model errors in this case increased the residuals used to detect and isolate a right- 
aileron failure. For the elevator failure, isolation (to a confusion set) was incorrectly declared 
with model errors present, but only an undetermined (not isolated) failure was declared in the 
simulation run without model errors. 

Summarizing the effects of model errors, it has been shown that small errors on the order 
of 10 percent in the model parameters have little effect on the actuator-path subsystem 
performance, although larger errors cause some false alarms. Performance of the aircraft-path 
subsystem is not severely affected by moderate departures from the design operating point. 
As expected, large departures from the design point produce unacceptable false alarms. At 
the design point, nominal errors in the model parameters affected the aircraft-path subsystem 
performance, but the effect was not extreme. 

Aircraft-Path Subsystem Designs for Operation in Turbulence 

As noted previously (see table 15), the baseline (BL) design produced unacceptable perfor- 
mance when operating in 10-ft/sec turbulence (gq = 10) because of the false alarms experienced 
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Table 22. Failure-Detection and Isolation Performance for Aircraft-Path Failures With 
Random-Model Errors and No Turbulence 


(a) Detection performance 


Failed surface 

Failure-detection time® as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 




1.15 


Rudder 




47.65 


Right elevator 




7.90 


Right aileron 




6.50 



°Time of failure declaration relative to time of failure. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 




a CS(RS,RE) 

Yes 

a CS{LS t LE) 

Yes 



a See symbol list for definition. 


(c) False- alarm performance 


Run 

Random- 
error set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time 5 a sec 

1 

A 

4 

2 

b LT b U 

12.70 

2 

B 

5 

0 


56.00 

3 

C 

1 

0 


56.00 


a Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
ft See symbol list for definition. 


by the aircraft-path subsystem. One way to improve false-alarm performance is to increase the 
thresholds in the trigger, verify, and isolate tests. Of course, increasing the thresholds affects 
the missed-detection and false-alarm performances, and a compromise solution may be required. 
An adaptive system may be required in which the thresholds and other parameters are adjusted 
as functions of the turbulence level. 

Recall that computation of the thresholds utilizes the covariance matrices E j(k) of the sum 
of k residuals u(j), and that the values of Ey(fc) depend on the white-noise and low-pass-noise 
covariances, E w and E^, respectively, of the residuals as determined by the truth model. For 
the BL design, E^ was determined by propagating the sensor noise into the residuals, and 
E^ was computed from the worst-case residuals experienced during a simulated climbing-turn 
maneuver (CT4) without sensor noise or turbulence. 

When the CT4 maneuver was flown in 10- ft/sec turbulence without failures (three runs 
with different random- number seeds), the aircraft-path residuals were examined, and it was 
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found that the sample variances of some residual components were significantly larger than 
the variances in the truth model, particularly for the q component. Furthermore, when the 
simulation was flown with sensor noise but without maneuvers, turbulence, or failures, the 
sample variances of the residuals were larger than the white-noise variances in the truth model 
for the A z , q , and r components. Thus, it appears that the noise variances in the truth model 
for the BL design were too small for the turbulence case, and as a result, the covariance matrices 
E^(A;) were incorrect and the thresholds were too low. 

Nonadaptive Designs for 10-ft/sec Turbulence 

Based on the preceding results, the variances of the white noise on the A z , <7, and r 
residuals were increased, and the new values (diagonals of E^, ) are shown in table 23. Also, 
the variances of the low-pass noise (diagonals of E^>) were increased for the turbulence case in 
accordance with the simulation results for the climbing turn with and without sensor noise in 
10-ft/sec turbulence; these new values are likewise shown in table 23. Also shown in the table 
are values for the diagonals &f{N) of the covariance matrix E f(N) of the sum S(k) of the N 
latest residuals for N = 20. 


Table 23. Errors for Aircraft-Path Truth Model for New- Threshold Design 


Residual 

Standard 
deviation of 
white noise, 
a cr w 

Low-frequency 
noise cutoff, 
rad /sec 

Standard 
deviation of 
low-frequency 
noise, b cr£ 

HPF 
cutoff 
frequency, 
rad /sec 

Standard 
deviation of 
total noise, 
c ct/(20) 

x- acceleration, w x 

0.39 ft /sec 2 

2.0 

0.419 ft /sec 2 

0.5 

5.46 ft/sec 2 

y-acceleration, v y 

.42 ft /sec 2 



.233 ft /sec 2 



3.36 ft/sec 2 

z- acceleration, v z 

1.60 ft /sec 2 



1.09 ft/sec 2 



15.04 ft/sec 2 

P-acceleration, vp 

.035 rad/sec 2 



.020 rad/sec 2 



.286 rad/sec 2 

Q-acceleration, vq 

.026 rad/sec 2 



.0130 rad /sec 2 



.193 rad/sec 2 

R- acceleration, vp 

.0157 rad/sec 2 



.0169 rad/sec 2 

' 


.220 rad/sec 2 


°Square root of diagonal terms of 
^Square root of diagonal terms of E^. 
c Square root of diagonal terms of T,j. 


Using these new values for noise variances in the truth model, two new aircraft-path 
subsystem designs for operation in 10-ft/sec turbulence were produced. These two designs, 
new-threshold (TG) design and new-projection- vector (PV10) design, and the results of their 
evaluation via simulation are discussed in the next two subsections. 

New- Threshold Design 

When new values for the covariance matrices Sy(fc) are used in the design procedure 
discussed in previous sections to design a new aircraft-path subsystem, the trigger thresholds, 
projection vectors, verify gains, verify thresholds, and isolate thresholds are all affected. If 
an adaptive system is required in order to achieve an acceptable false-alar m/missed- detection 
performance, then some of these parameters must be adjusted as functions of turbulence. 
Adjusting the projection vectors would be more complex computationally than adjusting the 
gains and thresholds, which are scalar quantities. Therefore, in the first of the two new designs, 
the new TG design, the projection vectors obtained in the BL design were retained. New 
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gains G J 4 and Gp. and new thresholds ty., and tj were computed by using the design 
procedure with the new covariance matrices £ j but retaining the old projection vectors Pj 
and P ^ Values for the gains and thresholds for the new TG design are shown in table 24. 
The trigger and verify thresholds have increased for each of the surfaces. Also, the minimum 
detectable trigger and verify signals, fg T and Sj, have increased; this increase indicates that a 

larger signal (failure magnitude) is required for reliable detection, as would be expected with 
the larger noise variances. 


Table 24. Design Results for Aircraft-Path Subsystem for New-Threshold Design 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

fsj' 

4.25 

4.25 

1.66 

1.66 

3.41 

8.22 

8.22 

tr 

-9.283 

-9.283 

-9.402 

-9.402 

-9.298 

-9.380 

-9.380 

s 

0.0717 

0.0717 

0.0598 

0.0598 

0.0702 

0.0620 

0.0620 

G a 

0.0717 

0.0717 

0.0598 

0.0598 

0.0702 

0.0620 

0.0620 

Gd 

0.00257 

0.00257 

0.00179 

0.00179 

0.00246 

0.00192 

0.00192 

ty 

0.00771 

0.00771 

0.00894 

0.00894 

0.00738 

0.00962 

0.00962 

5 */r 
(LT) 


0.0648 

0.0459 

0.0459 

0.1058 

0.0458 

0.0469 

(RT) 



.0459 

.0459 

.1058 

.0469 

.0458 

(LH) 




.0611 

.0453 

.0539 

.0539 

(RH) 





.0453 

.0539 

.0539 

(Ru) 






.0463 

.0463 

(LA) 







.0457 

(RA) 








(LT) 


0.194 

0.184 

0.184 

0.317 

0.183 

0.188 

(RT) 



.184 

.184 

.317 

.188 

.183 

(LH) 




.305 

.181 

.270 

.270 

(RH) 





.181 

.270 

.270 

(Ru) 






.185 

.185 

(LA) 







.228 

(RA) 









To evaluate the false-alarm performance of the new TG design, three runs with the CT4 
climbing-turn maneuver were made in 10- ft /sec turbulence; each run utilized different random 
sequences for the turbulence. Results are summarized in table 25. No false alarms and only two 
false triggers were experienced in the three runs for a total of 168 sec of aircraft-path subsystem 
operating time, compared with seven false alarms in 22.5 sec for the BL system under the same 
conditions. 

The performance of the new TG design in detecting and isolating aircraft-path failures under 
turbulent conditions = 10 ft/sec) was evaluated by simulating a loss of surface effectiveness, 
or a partially missing surface, for each of the four types of surfaces: stabilizer, rudder, elevator, 
and aileron. Each failure occurred at t = 5 sec, and the climbing-turn maneuver CT4 was 
initiated at t = 10 sec. 

Results of the simulation are shown in table 25 as a function of the percent effectiveness 
of the failed surface. With the surface at 60-percent effectiveness, the stabilizer, rudder, and 
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elevator failures were detected, but the aileron failure was not. The aileron failure at 40-percent 
effectiveness was detected. With no atmospheric turbulence, the BL system detected all four 
failures at 60-percent effectiveness (table 13). Also, the new TG design took slightly longer to 
detect the failures in turbulence than the BL system did with no turbulence. At 40-percent 
effectiveness, the stabilizer and elevator failures were detected more quickly by the TG design 
than at 60-percent effectiveness, but the stabilizer, rudder, and elevator failures at 80-percent 
effectiveness were not detected. 


Table 25. Failure-Detection and Isolation Performance for New-Threshold Design 

With 10- ft /sec Turbulence 

(a) Detection performance 


Failed surface 

Failure-detection time 0 

as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



1.15 

2.10 

h ND ' 

Rudder 




3.45 

b ND 

Right elevator 



7.10 

7.35 

b ND 

Right aileron 



6.50 

b ND 



“Time of failure declaration relative to time of failure. 
^See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



a CS ( RS,RE ) 

a U ( LS,RS,LE,RE ) 

a ND 

Rudder 




Yes 

a ND 

Right elevator 



a CS (RS,RE) 

a U{RA) 

a ND 

Right aileron 



Yes 

a ND 



“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

1 

0 


56.00 

2 

2 

1 

0 


56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 


In terms of isolation performance, at 60-percent effectiveness the rudder failure was isolated 
correctly, but the stabilizer and elevator failures resulted in undetermined failure declarations. 
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In the stabilizer case, the confusion set contained the failed surface, but in the elevator case 
it did not. At 40-percent effectiveness, the stabilizer and elevator failures were isolated to the 
correct confusion sets. Although there were a few actuator-path triggers, no actuator-path false 
alarms were experienced during these runs. In general, the new TG design performed almost as 
well in detecting and isolating failures in turbulence as the BL system did in a zero- turbulence 
environment, and the false-alarm performance of the new TG design was vastly superior to that 
of the BL system in turbulence. 

As mentioned previously, it is to be expected that the detection performance of the new 
TG design with no turbulence would be degraded from the BL system because the thresholds 
have been increased. To evaluate this performance, 15 runs were made with the new TG design 
in a no-turbulence environment with various simulated failures. The results are summarized in 
table 26. For failed-surface effectivenesses of 0 and 20 percent, failures were detected and isolated 
correctly. At 40-percent effectiveness, the aileron failure was not detected, and only the stabilizer 
failure was correctly isolated. Detection was quicker for the larger failures. Failures of the 
stabilizer, rudder, and elevator at 60-percent effectiveness were not detected. Detection/isolation 
performance was not quite as good as in turbulence (table 25), where failures were detected 
with smaller failure magnitudes (with 20 percent more effectiveness). Thus, the new TG design 
performed well. It did not perform quite as well as the BL system with no turbulence, but much 
better than the BL system in 10-ft/sec turbulence. 


Table 26. Failure-Detection and Isolation Performance for New-Threshold Design 

With No Turbulence 


(a) Detection performance 


Failed surface 

Failure- detection time a as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 

0.70 

0.85 

1.15 

b ND 


Rudder 

1.25 

2.65 

48.30 

b ND 


Right elevator 

0.65 

1.20 

7.25 

b ND 


Right aileron 

6.35 

6.60 

b ND 




°Time of failure declaration relative to time of failure. 
ft See symbol list for definition. 


(b) Isolation performance 



Failure isolation as a function of percent surface effectiveness 


Failed surface 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 

a CS{RS,RE) 

a CS{RS,RE) 

a CS (RS,RE) 

a ND 


Rudder 

Yes 

Yes 

a U ( LT ) 

a ND 


Right elevator 
Right aileron 

a CS (RS,RE) 
Yes 

a CS ( RS,RE ) 
Yes 

a U(RA) 

a ND 

a ND 



a See symbol list for definition. 
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New- Projection- Vector Design 

While the new-threshold design was intended for operation in 10-ft/sec turbulence, in terms 
of thresholds and gains, it was not completely designed for turbulence, in that the projection 
vectors from the BL design were retained. The optimum system for use in 10-ft/sec turbulence, 
in terms of the design procedure previously described, would be a system completely redesigned 
by using the noise standard deviations for the turbulence truth model in table 23. Such an 
aircraft-path subsystem, referred to herein as the new-projection- vector (PV10) design, was 
designed and evaluated for comparison with the new TG design. Results of the design process 
are shown in tables 27 to 29. It is interesting to note the projection vectors (table 27) for the 
trigger and verify tests and to compare them with those in the baseline design (table 8). In the 
BL design, the tests for thrust failures depended almost entirely on the yaw-rate residual (the 
rv-component of the projection vector is 0.9999) and not at all on the pitch-rate residual. In 
the new PV10 design, however, the thrust-failure tests depend significantly on the pitch-rate 
residual. A similar change occurred in the vector for the rudder-failure tests. On the other 
hand, the projection vectors for the horizontal tail failures remain unchanged. Also, while the 
minimum detectable failure magnitudes f§ for the new PV10 design are considerably larger 

* i 

than for the BL system, they are smaller than those for the new TG design. 


Table 27. New-Projection- Vector Design Results for Aircraft-Path Trigger Test 
After Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

P: 

("i) 

0.0376 

0.0376 

0 

0 

0 

0 

0 

H) 

0 

0 

0 

0 

.0445 

0 

0 

(v*) 

0 

0 

0 

0 

0 

0 

0 

("p) 

0 

0 

0 

0 

.446 

.749 

-.749 

K) 

.545 

.545 

-1.0 

-1.0 

0 

-.662 

-.662 

M 

.838 

-.838 

0 

0 

-.894 

0 

0 


.295 

.295 

.193 

.193 

.278 

.250 

.250 

tj 

—9.086 

-9.086 

-9.402 

-9.402 

-9.138 

-9.226 

-9.226 

f Sj' 

3.44 

3.44 

1.66 

1.66 

2.77 

6.46 

6.46 


Table 28. New-Projection- Vector Design Results for Aircraft-Path Verify Test 
After Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

s 

0.0914 lb x 10 3 

0.0914 lb x 10 3 

0.0598° 

0.0598° 

0.0862° 

0.0774° 

0.0774° 

Ga 

.0914 

.0914 

.0598 

.0598 

.0862 

.0774 

.0774 

Gd 

.00418 

.00418 

.00179 

.00179 

.00372 

.00300 

.00300 

k T 

3 

3 

5 

5 

4 

5 

5 

tv 

.01254 

.01254 

.00894 

.00894 

.01486 

.01498 

.01498 
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Table 29. New-Project ion- Vector Design Results for Aircraft-Path Isolate Test 
After Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

vSt , : 








*/j 

(LT) 


0.418 

0.385 

0.390 

0.585 

0.360 

0.360 

(RT) 



.390 

.385 

.585 

.360 

.360 

(LH) 




.394 

.293 

.348 

.348 

(RH) 





.293 

.348 

.348 

(Ru) 






.341 

.341 

(LA) 







.295 

(RA) 








Si/y 

(LT) 


0.0648 

0.0597 

0.0604 

0.0907 

0.0558 

0.0558 

(RT) 



.0604 

,0597 

.0907 

.0558 

.0558 

(LH) 




.0611 

.0453 

.0539 

.0539 

(RH) 





.0453 

.0539 

.0539 

(Ru) 






.0529 

.0529 

(LA) 







.0457 

(RA) 








ki/j-. 








(LT) 


3 

3 

3 

3 

4 

4 

(RT) 



3 

3 

3 

4 

4 

(LH) 




5 

4 

5 

5 

(RH) 





4 

5 

5 

(Ru) 






4 

4 

(LA) 







5 

(RA) 








(LT) 


0.194 

0.179 

0.181 

0.272 

0.223 

0.223 

(RT) 



.181 

.179 

.272 

.223 

.223 

(LH) 




.305 

.181 

.270 

.270 

(RH) 





.181 

.270 

.270 

(Ru) 






.212 

.212 

(LA) 







.228 

(RA) 


. 


. 





To evaluate the false-alarm performance of the new PV10 design, three runs with the CT4 
climbing-turn maneuver were made with <jq = 10 ft /sec; each run used different random 
sequences for the turbulence. Results are summarized in table 30. One false alarm (false 
detection) and five false triggers were experienced in the three runs, for a total of 168 sec 
of aircraft-path subsystem operating time, compared with no false alarms and only two false 
triggers for the new TG design under the same conditions and compared with seven false alarms 
in 22.5 sec for the BL system. Thus, in terms of false-alarm performance in turbulence, the new 
PV10 design was far superior to the BL design, but not quite as good as the new TG design. 
It is not known why the new PV10 design exhibited slightly poorer false-alarm performance, 
contrary to expectations, than the new TG design. 
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Table 30. Failure-Detection and Isolation Performance for New-Projection- Vector 

Design With 10- ft /sec Turbulence 

(a) Detection performance 


Failed surface 

Failure-detection time 0 

as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



1.15 

13.30 

14.30 

Rudder 




3.45 

38.35 

Right elevator 



7.10 

7.35 

6 ND 

Right aileron 




6.55 

13.05 


a Time of failure declaration relative to time of failure. 
& See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 



a CS{RS , RE) 
a CS(RS t RE) 

a RA 

Yes 

a U ( RA ) 
Yes 

a U(LT) 

Yes 

a ND 

Yes 


a See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

3 

0 


56.00 

2 

2 

2 

1 

b LT 

56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
& See symbol list for definition. 


The performance of the new PV10 design in detecting and isolating aircraft-path failures 
under turbulent conditions (erg — 10 ft/sec) was evaluated by simulating a loss of surface 
effectiveness during the climbing-turn maneuver CT4, and results are shown in table 30 as 
a function of the percent effectiveness of the failed surface. With the surface at 60-percent 
effectiveness, all failures were detected, and at 80 percent, all failures but the elevator were 
detected. This performance is somewhat better than that of the new TG design (table 25), 
which failed to detect failures at 80-percent effectiveness. With respect to isolation performance, 
the new PV10 design was able to correctly isolate rudder and aileron failures even at 80-percent 
effectiveness, an improvement over the new TG design. However, the two designs were nearly 
equal in their ability to isolate stabilizer and elevator failures in 10-ft/sec turbulence. 
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Results of nine simulation runs to evaluate the performance of the new PV10 design with no 
turbulence are tabulated in table 31. In this environment, failure-detection performance of the 
new TG and new PV10 designs were similar; neither detected failures at 60-percent effectiveness, 
and both detected three out of four failures at 40-percent effectiveness. Isolation performance 
of the new PV10 design was better, in that it correctly isolated the three failures it detected at 
40-percent effectiveness. 


Table 31. Failure-Detection and Isolation Performance for New-Projection- Vector 

Design With No Turbulence 


(a) Detection performance 


Failed surface 

Failure- detection time a 

as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



1.15 

b ND 


Rudder 



47.35 

b ND 


Right elevator 


1.35 

ND 

b ND 


Right aileron 



6.60 

b ND 



“Time of failure declaration relative to time of failure. 


^See symbols list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 


a CS (RS,RE) 

a CS{RS,RE) 

Yes 

a ND 

Yes 

a N 

D 



“See symbol list for definition. 


The performance of the three designs is summarized in table 32. The baseline system 
performed best with no turbulence, where it detected four out of four failures at 60-percent 
effectiveness; the other two designs detected none of those. In 10-ft/sec turbulence, however, 
the BL system was unusable as a result of false alarms, while the other two performed well, the 
new-threshold design was the best with respect to false alarms. The new TG design and the new 
PV10 design both performed well in detecting and isolating failures in turbulence, but the new 
PV10 design performed better. It detected three out of four failures at 80-percent effectiveness, 
and the new TG design detected none out of three. The new PV10 design is sufficiently superior 
to the new TG design to warrant using it as the basis for an adaptive design. In other words, 
an aircraft-path subsystem design that is adaptive to varying turbulence levels should include 
adaptive projection vectors as well as adaptive thresholds and gains. 
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Table 32. Summary of Performance of Baseline, New-Threshold, and 
New- Project ion- Vector Designs 

(a) Detection and isolation of failures with no turbulence 


Design 

Number of failures/number detected/number correctly isolated 0 
as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Baseline 




4/4/3 

4/1/0 

New TG 

4/4/4 

4/4/4 

4/3/1 

3/0/0 


New r PV10 


1/1/1 

4/3/3 

4/0/0 



°For stabilizer and elevator failures, isolated to horizontal tail (confusion set containing only stabilizer and 
elevator) . 


(b) Detection and isolation of failures with 10- ft /sec turbulence 


Design 

Number of failures/number detected/number correctly isolated 0 
as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Baseline 
New TG 
New PV10 



3/3/3 

2/2/2 

4/3/1 

4/4/2 

3/0/0 

4/3/2 


°For stabilizer and elevator failures, isolated to horizontal tail (confusion set containing only stabilizer and 
elevator). 


(c) False- alarm performance (no failures) with 10- ft /sec turbulence 


Design 

Number of 
false triggers 

Number of false alarms 
(false detections) 

FDI active 
time, 0 sec 

Baseline 

11 

7 

22.5 

New TG 

2 

0 

168.0 

New PV10 

5 

1 

168.0 


“Time aircraft-path subsystem is operational. 


Adaptive Type Designs 

Interpolated Design 

Superior FDI performance is achieved when different projection vectors, gains, and thresholds 
are used in zero turbulence and in 10-ft/sec turbulence. In particular, the baseline (BL) design 
was superior at zero turbulence, and the new-projection- vector (PV10) design was superior at 
10-ft/sec turbulence. In an operational FDI system, some technique must be incorporated into 
the system to switch between these two designs as the level of turbulence changes. For improved 
performance in other levels of turbulence, it seems logical that a smooth transition between the 
two designs as a function of the turbulence level would be preferred over an abrupt transition, 
or switch. Algorithms were implemented in the software to linearly interpolate between the 
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BL design values in zero turbulence and the new PV10 design values at 10 ft /sec turbulence 
for each of the trigger thresholds t T ., the trigger and verify projection vectors Pj, the verify 
thresholds ty., the isolate thresholds tj , and the isolate projection vectors Pj/j- Interpolation 
was performed as a function of the variable TURB, which represents the system’s knowledge of 
the standard deviation of the turbulence, or gusts a G . In fact, the algorithms also extrapolated 
to levels higher than the 10-ft/sec level of the new PV10 design. After interpolation, the new 
trigger and isolate projection vectors were renormalized to unit length. The FDI system software 
did not use separate variables for the verify projection vectors and the verify gains, but combined 
them into one set of vectors P', where 


p 5 = GaF i (!° 7 ) 

The algorithms interpolated the vectors P-, and these were then used without normalization. 

To perform the interpolation, the level of the turbulence a G must be known or estimated, 
and the limiting performance of the system would be when a q is known exactly. To evaluate this 
limiting performance, the algorithms in this design used the true value of turbulence by setting 
TURB = oq in the interpolation computations, and the system was called the interpolated 
design. Note that a G is the value specified for the simulation run, not the sample standard 
deviation of the actual sample sequence produced by the random-number generator. 

To evaluate the false-alarm performance of the interpolated design at an intermediate 
turbulence level, three simulation runs were made while executing the CT4 climbing-turn 
maneuver in 5-ft/sec turbulence (TURB = a G = 5) with no failures. For comparison, similar 
runs were made with the BL and new PV10 designs. Results are summarized in table 33. 
Under these conditions, the BL design experienced 6 false alarms and 40 false triggers in 168 sec 
of operation. On the other hand, both the interpolated design and the new PV10 design 
experienced no false alarms and no false triggers in identical runs. 

The performance of the interpolated design in detecting and isolating aircraft-path failures in 
5-ft/sec turbulence was evaluated by simulating loss of surface effectiveness during the climbing- 
turn maneuver CT4; for comparison, similar runs were made with the new PV10 design. Results 
are shown as a function of the percent effectiveness of the failed surface for the new PV10 
design in table 34 and for the interpolated design in table 35. With the surface at 60-percent 
effectiveness, all failures were detected by the interpolated design; however, only the rudder 
failure was detected by the new PV10 design. Furthermore, the interpolated design correctly 
isolated three of the four failures. At 80-percent effectiveness, the interpolated design detected 
and isolated the rudder failure, but not the stabilizer, elevator, and aileron failures. Thus, in 
5-ft/sec turbulence the performance of the interpolated design was superior to that of the new 
PV10 design. 

To assess false-alarm performance of the interpolated design in turbulence greater than the 
upper (PV10) design level of 10 ft/sec, three additional simulation runs with no failures were 
made in 1 5-ft/sec turbulence. The TURB was set equal to 15, so that the thresholds and 
projection vectors were extrapolated beyond the PV10 design level. Results of the runs with 
this extrapolated design are summarized in table 36. Nine false triggers and six false alarms 
were experienced in less than 82 sec. Thus, it appears that adjustment of the thresholds and 
projection vectors by linear extrapolation beyond the upper design level is not acceptable. 

To obtain acceptable aircraft-path subsystem performance in turbulence significantly greater 
than 10 ft /sec, it appears that additional design points at higher turbulence levels must be 
obtained. Thresholds and projection vectors can then be calculated by interpolation between 
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Table 33. False- Alarm Performance Summary With 5-ft/sec Turbulence 


(a) Baseline design 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, a sec 

1 

1 

11 

3 

b RT 

56.00 

2 

2 

12 

1 

b RT 

56.00 

3 

3 

17 

2 

h RT, b Ru 

56.00 


°Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
^See symbol list for definition. 


(b) New- projection- vector (PV10) design 


Run 

Random- 
sequence set . 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, a sec 

1 

1 

0 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

0 

0 


56.00 


a Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 


(c) Interpolated design (TURB = 5 ft /sec) 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time,® sec 

1 

1 

0 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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Table 34. Failure-Detection and Isolation Performance for New-Projection- Vector 

Design With 5-ft/sec Turbulence 


(a) Detection performance 



Failure-detection time“ 

as a function of percent surface effectiveness 

Failed surface 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 



1.15 

6.85 

6.40 

b ND 

34.45 
b ND 

b ND 

b ND 


“Time of failure declaration relative to time of failure. 
& See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation 

as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



a CS{R S,RE) 

a ND 


Rudder 




Yes 

a ND 

Right elevator 



a CS (RS,RE) 

a ND 


Right aileron 



Yes 

a ND 



“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

0 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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Table 35. Failure-Detection and Isolation Performance for Interpolated Design 

With 5- ft /sec Turbulence 

(a) Detection performance 


Failed surface 

Failure-detection time a 

as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 




1.15 

b ND 

Rudder 




3.60 

48.55 

Right elevator 



6.50 

7.25 

b ND 

Right aileron 




6.45 

b ND 


a Time of failure declaration relative to time of failure. 
& See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 

• 



a CS ( RS,RE ) 

a ND 

Rudder 




Yes 

Yes 

Right elevator 



a CS (RS,RE) 

a U(RA) 

a ND 

Right aileron 




Yes 

a ND 


“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

0 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

0 

0 


56.00 


a Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 


Table 36. False-Alarm Performance of Extrapolated Design With 15-ft/sec Turbulence 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

2 

2 

b U, b RA 

14.20 

2 

2 

2 

2 

b U b RS b RE 

12.50 

3 

3 

5 

2 

b U b RA 

55.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
& See symbol list for definition. 
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the appropriate design points. To this end, additional no-failure simulation runs were made in 
20- ft /sec turbulence, and the residuals were processed to obtain new values for the diagonals 
of the white-noise and low-pass-noise covariance matrices, and 5^, respectively. These 
new values were input into the FDI design program to create another new-projection-vector 
design. When this design was evaluated in 20- ft /sec turbulence, six false triggers and four false 
alarms were experienced in 57.35 sec of operation during three simulation runs. To improve 
this performance, the trigger, verify, and isolate thresholds were increased by a factor of 1.5. 
With these new thresholds, no false alarms were encountered in three no-failure simulation runs 
in 20-ft/sec turbulence. The aircraft-path subsystem was then tested in 15-ft/sec turbulence. 
Thresholds and projection vectors were obtained by linearly interpolating (TURB = 15) between 
this latest design and the PV10 design. One false alarm was experienced in each of three no- 
failure simulation runs, again an unacceptable level of performance. 

To improve system performance in the higher turbulence levels, the noise covariance matrices 
and for 20-ft/sec turbulence were increased by a factor of 1.5, and these new values 
(shown in table 37) were used to create a new aircraft-path subsystem design (PV20). This 
procedure created new projection vectors, gains, and thresholds rather than just increasing the 
thresholds, and the resulting design values are summarized in tables 38 to 40. Nearly all the 
thresholds tj' , ty., and tj increased relative to the PV10 design shown in tables 27 to 29, and 

some of the minimum detectable failure levels f ST . and s^j increased dramatically because of 
the higher noise levels. 


Table 37. Errors for Aircraft-Path Truth Model With PV20 Design 


Residual 

Standard 
deviation of 
white noise, 
a °w 

Low-frequency 
noise cutoff, 
rad / sec 

Standard 
deviation of 
low-frequency 
noise, b (Jt 

HPF 

cutoff 

frequency, 

rad/sec 

Standard 
deviation of 
total noise, 
c a/(20) 

x- acceleration, v x 

0.599 ft/sec 2 

2.0 

1.31 ft /sec 2 

0.5 

16.5 ft /sec 2 

y-acceleration, v y 

.639 ft /sec 2 



.768 ft /sec 2 



9.92 ft /sec 2 

z- acceleration, v z 

2.64 ft /sec 2 



5.33 ft /sec 2 



67.3 ft/sec 2 

P- acceleration, up 

.0599 rad/sec 2 



.102 rad/sec 2 



1.29 rad/sec 2 

Q-acceleration, vq 

.0388 rad /sec 2 



.0442 rad/sec 2 



.573 rad /sec 2 

R- acceleration, up 

.0236 rad /sec 2 



.030 rad/sec 2 


* 

.386 rad/sec 2 


°Square root of diagonal terms of E w . 
^Square root of diagonal terms of E*. 
c Square root of diagonal terms of E/ . 


The PV20 design was tested in 20-ft/sec turbulence to evaluate false-alarm performance, 
and the results are shown in table 41. In three simulation runs with different random-number 
seeds, two false triggers and no false alarms were experienced in 168 sec of operation. When 
operated in 15-ft/sec turbulence {a G = TURB = 15), the system parameters were interpolated 
between the PV10 and PV20 values. For three no-failure runs, the results shown in table 42 
were six false triggers and one false alarm in 131 sec of operation. While some improvement 
in false-alarm performance at the higher turbulence levels would be required for an operational 
system, it was decided to continue with the evaluation of the failure-detection performance of 
this design. 
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Table 38. PV20 Design Results for Aircraft-Path Trigger Test After 
Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

P: 












(**) 

0.0151 

0.0151 

0 

0 

0 

0 

0 

K) 

0 

0 





.0176 

0 

0 










0 

0 

0 

K) 





- 



' 

0 

.439 

-.439 

K) 



> 


-1.0 

-1.0 

0 

-.899 

-.899 

M 

.9999 

-.9999 

0 

0 

-.9998 

0 

0 


.459 

.459 

.573 

.573 

.423 

.767 

.767 

t T 

-8.577 

-8.577 

-8.224 

-8.224 

-8.687 

-7.623 

-7.623 

hr 

8.11 

8.11 

4.93 

4.93 

6.27 

25.21 

25.21 


Table 39. PV20 Design Results for Aircraft-Path Verify Test After 
Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

s 

0.142 lb x 10 3 

0.142 lb x 10 3 

0.178° 

o 

00 

0 

■ 

0.131° 

0.238° 

0.238° 

Ga 

.142 

.142 

.178 

—4 

00 

.131 

.238 

.238 

G n 

.0101 

.0101 

.0158 

.0158 

.00862 

.0282 

.0282 

k T 

2 

2 

2 

2 

2 

2 

2 

W 

.0203 

.0203 

.0315 

.0315 

.0172 

.0565 

.0565 


The performance of the interpolated design in detecting and isolating failures in higher 
turbulence was evaluated by simulating loss of surface effectiveness. The results for turbulence 
levels of 20 ft /sec and 15 ft /sec are tabulated in tables 41 and 42, respectively. With TURB = 
oq = 20, no failures were detected at 60-percent effectiveness, and only the rudder and aileron 
failures were detected at 40 percent. At 0- and 20-percent effectiveness, all stabilizer, elevator, 
and rudder failures were detected; stabilizer and rudder detection occurred in less than 3 sec. 
The stabilizer and rudder failures were not isolated, but rather were undetermined failures. 
However, the resulting confusion set correctly contained the right stabilizer and elevator in the 
case of the stabilizer failure, and contained only the rudder in the case of the rudder failure. In 
the latter case, an undetermined failure was declared repeatedly during the run. Nevertheless, 
the fact that an isolation decision was not made in these cases indicates that perhaps the 
isolation thresholds are too high or that the isolation projection vectors need modification. The 
right-elevator failures, on the other hand, were isolated incorrectly to the right aileron. This 
performance was not nearly as good as the system performance in 10-ft/sec turbulence, where 
detection and isolation generally occurred with less severe failures. 

With TURB = <jq — 15 (table 42), stabilizer and elevator failures were detected at 40-percent 
surface effectiveness, aileron failures at 60 percent, and rudder failures at 80 percent. This 
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Table 40. PV20 Design Results for Aircraft-Path Isolate Test After 
Projection- Vector Optimization 


Design 

parameter 

Left 

thrust 

Right 

thrust 

Left 

horizontal 

tail 

Right 

horizontal 

tail 

Rudder 

Left 

aileron 

Right 

aileron 

as ‘„i 

( LT ) 


1.007 

0.546 

0.546 

1.96 

0.830 

0.857 

(RT) 



.546 

.546 

1.96 

.857 

.830 

(LH) 




1.757 

.691 

1.435 

1.435 

(RH) 





.691 

1.435 

1.435 

(Ru) 






.833 

.833 

(LA) 







1.014 

(RA) 








VP 

(LT) 


0.156 

0.0846 

0.0846 

0.304 

0.129 

0.133 

(RT) 



.0846 

.0846 

.304 

.133 

.129 

(LH) 




.272 

.107 

.222 

.222 

(RH) 





.107 

.222 

.222 

(Ru) 






.129 

.129 

(LA) 







.157 

(RA) 








k i/r 








(LT) 


2 

2 

2 

2 

2 

2 

(RT) 



2 

2 

2 

2 

2 

(LH) 




2 

2 

2 

2 

(RH) 





2 

2 

2 

(Ru) 






2 

2 

(LA) 







2 

(RA) 








(LT) 


0.312 

0.169 

0.169 

0.608 

0.257 

0.266 

(RT) 



.169 

.169 

.608 

.266 

.257 

(LH) 




.545 

.214 

.445 

.445 

(RH) 





(O 

h— ‘ 

.445 

.445 

(Ru) 






.258 

.258 

(LA) 







.315 

(RA) 









performance is significantly better than at cq = 20 ft/sec, but not as good as at oq = 10 ft /sec. 
In this case, the rudder and aileron failures were correctly isolated, and the stabilizer and elevator 
failures were isolated to the proper confusion set. 

The trigger and verify statistics and thresholds for each surface for a right-aileron failure are 
plotted in figures All and A12 for 20-ft/sec and 15-ft/sec turbulence, respectively. The statistics 
for the right aileron are repeated in figure 17. The thresholds in figure All are the values for 
the PV20 design. The thresholds in figure A12 are the values obtained by interpolating midway 
(TURB = 15) between the PV10 and PV20 designs and, of course, are lower (more negative) 
than those in figure All for TURB — 20. The verification/isolation process is initiated by a 
right-thrust trigger at 17.55 sec into the run. (See fig. All.) All the right-aileron isolation tests 
passed in favor of the right aileron by 18.10 sec (not shown in fig. All), but a failure/isolation 
is not declared until the right aileron verifies at 18.55 sec. No other verify tests passed. 
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Table 41. Failure-Detection and Isolation Performance for Interpolated Design 

With 20- ft /sec Turbulence 


(a) Detection performance 



Failure-detection time“ as 

a function of percent surface effectiveness 

Failed surface 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 

2.25 

2.65 

b ND 

b ND 


Rudder 

1.65 

1.85 

2.40 




Right elevator 

14.40 

14.45 

b ND 




Right aileron 



14.30 

' 

' 



“Time of failure declaration relative to time of failure. 
& See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 

a U (RS,RE) 

a U (RS.RE) 

a ND 

a ND 


Rudder 

a U ( Ru ) 

a U (Ru) 

a U (Ru) 




Right elevator 

a RA 

a RA 

a ND 




Right aileron 



Yes 

- 




“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

1 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

1 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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Table 42. Failure-Detection and Isolation Performance for Interpolated Design 

With 15-ft/sec Turbulence 


(a) Detection performance 



Failure-detection time“ 

as a function of percent surface effectiveness 

Failed surface 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 



7.70 

38.55 

b ND 

4.10 
6 ND 
8.45 

13.20 

b ND 


a Time of failure declaration relative to time of failure. 
6 See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



a CS{RS,RE ) 

a ND 


Rudder 




Yes 

Yes 

Right elevator 



a CS ( RS,RE ) 

a ND 


Right aileron 




Yes 

a ND 


“See symbol list for definition. 


(c) False- alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time,® sec 

1 

1 

3 

0 


56.00 

2 

2 

1 

1 

b RS,RE 

16.60 

3 

3 

2 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
& See symbol list for definition. 
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s Tra 


s Vra 



Time, sec 


(a) 20- ft/sec turbulence. 



Time, sec 


(b) 15- ft /sec turbulence. 

Figure 17. Aircraft-path right-aileron trigger and verify statistics for right-aileron partially missing surface failure 

(40-percent effectiveness). Interpolated design. 

The degradation in the performance of the aircraft-path subsystem in turbulence above 
10 ft/sec, particularly the occurrence of false alarms that necessitated the increasing of the 
noise covariances above the measured values, indicates that some improvements in the design 
process are required. Perhaps some refinement of the design and truth models is necessary. 
The noise variances and ct| for the truth model in 20-ft/sec turbulence are far greater than 
those assumed for the baseline design (ref. 25), as can be seen by comparing the values in 
table 37 with those in table 6. Nevertheless, the process of linearly interpolating the projection 
vectors, gains, and thresholds worked well, as evidenced by the failure-detection and isolation 
performance in 15-ft/sec turbulence, where performance exceeded that at 20 ft/sec, and by 
the very good failure-detection/isolation performance and excellent false- alarm performance at 
5-ft/sec turbulence. 

Actuator-Path Subsystem 

Because the aircraft-path subsystem is considerably more complex than the actuator-path 
subsystem, the emphasis when evaluating performance in turbulence has been placed on the 
aircraft path. However, turbulence did have some effect on the actuator-path subsystem. 
Table 43 summarizes the false-alarm performance of the actuator path during the three no- 
failure climbing-turn simulation runs in 20-ft/sec turbulence. There were a total of 29 false 


78 



triggers and 5 false alarms (false verifies or detections) in 168 sec of operation. Of the false 
alarms, two were rudder, two were right aileron, and one was left aileron. Obviously, this 
performance is unacceptable, and some redesign of the actuator-path subsystem is required. 
One facet of the design that should be examined is the determination of variances of the noise, 
or error, terms in the truth model. An adaptive system that adjusts thresholds as a function of 
the turbulence level may be necessary. Further work in this area has not been pursued, however, 
because it is believed that if an adaptive aircraft-path subsystem can be successfully developed, 
similar techniques can easily be applied to the actuator path. 


Table 43. Actuator-Path Subsystem False- Alarm Performance With 20- ft/sec Turbulence 


Run 

Random- 
sequence set 

Maneuver 

Number of 
triggers 

False 

alarms 

FDI active 
time, 0 sec 

1 

1 

CT4 

16 

a LA, b RA 

56.00 

2 

2 

CT4 

5 

b Ru 

56.00 

3 

3 

CT4 

8 

b R u , b RA 

56.00 


°Time actuator-path subsystem is operational. 
& See symbol list for definition. 


Adaptive Design 

As shown previously, improved aircraft-path subsystem performance in turbulence could 
be obtained by using the interpolated design that adjusts the gains, projection vectors, and 
thresholds as functions of the turbulence level TURB. In the interpolated design, the value of 
TURB is provided to the system a priori by setting it equal to oq , the standard deviation of the 
turbulence specified for the simulation run and input to the simulation for use by the random- 
number generator. In an operational system, this value is not known and must be determined in 
real time. Thus, the first step in evolving the interpolated design into a self-contained adaptive 
FDI system was the development of a turbulence estimator. 

Turbulence estimator . Several different techniques were considered for obtaining an estimate 
of the standard deviation of the turbulence &q , or wind gusts. Among those techniques 
briefly evaluated in simulation were averaging the squared, filtered output of the body-mounted 
accelerators and averaging the squared, filtered outputs of the angle-of-attack and angle-of- 
sideslip sensors. These methods proved inferior to a technique developed by Deckert et al. 
(ref. 34) for use in the NASA F-8 digital fly- by- wire program. This technique is discussed in 
more detail herein. 

Consider the acceleration a of the aircraft at the center of gravity: 

a = V + o>xV-g (108a) 

or 

V-a-cjxV + g (108b) 

where the variables are inertial quantities in body axes. A discrete time approximation to 
equation (108b) is given in predictor-corrector form by equations (109) to (111) as follows: 

VP(k) = V(fc - 1) + [a * m (k) + g *(k) - u4(A:) x V* m (k)] AT (109) 
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where V p (k) is the predicted velocity at sample k, V(fc — 1) is the estimated velocity at sample 
k — 1, and AT is the sample interval. The starred quantities are defined subsequently. Define 
a residual £{k) as 


<(k)=V*m(k)-V P (k) 

and let the estimated velocity V(fc) be computed from 

V(k) = VP(k) + G E C(k) 


( 110 ) 


( 111 ) 


To improve the accuracy of the integration of acceleration in equation (109), the measured 
accelerations, attitude rates, and velocities are averaged over the k and k — 1 samples. Thus, 
the starred variables are defined as 


where 


3 m(k) — 2 ^ a m(k ~ 1 )] 

^m( k ) = \ [^m(k) + u> m (k - 1)] 
^rn(k) = 2 [Vm(k) + V m (& — 1)] 

g*(*) = 5fe(*) + g(*-i)] 


d-mik) 


-Afn x (k)- 

A c my (k) 

■A c m z (k). 


( outputs of body-mounted 
accelerometers after compensation 
for off-center-of-gravity effects 


f P> m{k) "I 


w m(k ) — 


Qm{k) 


Um(fc)J 


( attitude-rate gyro outputs ) 


(112a) 

(112b) 

(112c) 

(112d) 

(113a) 

(113b) 


V m ( k) = 


cos /3m(k) cos ot m (k) 

sin (3 m (k) 

Lcos /3 m (k) sin a m (k) 


V'r {k) ( measured airspeeds ) 


(113c) 


-sin<9 m (A;) 

g (k) = cos 0 m (k) sin $ m (k) | g (113d) 

. cos 6 m (k) cos $ m {k ) . 

The acceleration in equation (109) is inertial, but the velocity V m is relative to the air. 
Therefore, 

Vm(k) = V(k) - V w (k) + e(k) (1 14) 


where V(k) is inertial aircraft velocity, V w (k) is wind velocity, and e(k) is measurement error. 
If the measurements are perfect, the aircraft acceleration is constant or linearly changing, the 
gain G E is small, and the wind velocity V w {k) has zero mean and varies rapidly compared 
with the estimator response, then the estimated velocity V(A;) tends toward the inertial velocity 
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V(fc), and the residuals <(fc) approach the wind velocity V w {k). The residuals can then be used 

to estimate the level of the wind gusts, or turbulence. 

Each channel {U, V, W, or x, y, z ) of equations (109) to (111) should be included in a 
turbulence estimator, one channel of which is shown in figure 18. The residuals are high-pass 
filtered, to remove bias terms, and then squared. The squared output is then averaged in a 
low-pass filter to form an estimate of the variance of the turbulence in that channel. During 
the simulation evaluation, it was found that sensor noise in the residuals produced a significant 
nonzero value for the estimate when the actual turbulence was set to zero. To reduce this effect, 
a low-pass filter was implemented in the estimator preceding the high- pass filter. 



Figure 18. One channel of turbulence level estimator. 


The estimator was evaluated by using the 737 nonlinear simulation over specified turbulence 
levels a G of 0 to 20 ft/sec. At a G = 10 ft/sec, three simulation runs were made during straight 
and level flight, with a different sample sequence from the random-number generator for each 
run. These three runs were repeated while executing the CT4 climbing-turn maneuver. Similar 
runs were made with a G = 20 ft/sec. 

Results are shown in figure 19 for each of the three channels of the estimator. The horizontal 
axis is the sample standard deviation of the turbulence ay for the 60-sec run computed as the 
rms of the sample standard deviations of the simulated gusts ay , ay , and ay , that is, 


(T'f 


fsC 


2 , 2 
a U + °V 


2 > 
+ °W, 


1 1/2 


(115) 


The vertical axis is the mean value over the 60-sec run of the estimate ay, ay, or ay/ . 
The average error in these estimates was —0.57, -0.98, and 1.1 ft/sec for ay, ay, and ay , 
respectively. Simulation results showed that the accuracy of the estimator could be improved 
if the outputs of the three channels were combined in an rms fashion to form an estimate ay, 
as shown in the final design (fig. 20). Mean values of ay are also plotted in figure 19, and 
these estimates are more accurate. A time-history plot of the estimate ay is shown in figure 21, 
together with a plot of the sample standard deviation (rms of the three components) of the most 
recent 100 samples (5 sec) of the simulated turbulence for a run where a G = 10 ft/sec. Although 
the estimate certainly does not track the sample standard deviation exactly, it is anticipated 
that the estimator will be sufficiently accurate to use in an adaptive FDI system. Parameter 
values for the final estimator design are listed in table 44. 
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Figure 19. Results for turbulence level estimator. 



Figure 20. Turbulence level estimator final design. 



Time, sec 


Figure 21. Time history of turbulence level estimator output. 
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Table 44. Parameter Values for Final Design of Turbulence Level Estimator 


Parameter 

Variable 

Value 

Estimator feedback gain 

Ge 

0.010 

Low-pass noise filter time constant, sec 

Tnlp 

.200 

High- pass- filter time constant, sec 

Thp 

5.000 

Low-pass averaging filter time constant, sec 

T lp 

5.000 

U-channel gain 

Gu 

2.110 

V- channel gain 

G v 

1.650 

W- channel gain 

Gw 

1.400 

Output gain 

Gj 

1.045 


Design description. In the interpolated design previously discussed, the thresholds and 
projection vectors were determined by linear interpolation between two end points according 
to the independent variable TURB. Two sets of end points were used: the BL and the PV10 
design values for TURB between 0 and 10, or the PV10 and the PV20 design values for TURB 
between 10 and 20, as selected before the simulation run. The value of TURB was set equal 
to the value of ctq specified for the run; thus, the interpolated thresholds, gains, and vectors 
stayed constant throughout a run. 

For the adaptive design, the turbulence estimator was implemented in the FDI software. At 
each sample interval, an estimate of the level of turbulence chp was computed, and TURB was 
set equal to this value before the aircraft-path subsystem computations were performed. The 
range of the independent variable TURB was divided into two regions, and linear interpolation 
was performed as shown in figure 22. For TURBL < TURB < TURBM, the dependent 
variables were interpolated between YL and YM, corresponding to the BL and PV10 design 
values, respectively. For TURB > TURBM, the dependent variables were interpolated between 
(or extrapolated above) YM and YH, corresponding to the PV10 and PV20 design values, 
respectively. Values of 0, 10, and 20 for TURBL, TURBM, and TURBH, as used in the 
interpolated design, were inappropriate for the adaptive design; these values were those specified 
for the turbulence standard deviation for a simulation run, but were not the actual sample 
standard deviations, which were generally larger. The turbulence estimator attempts to estimate 
the sample standard deviation of approximately the latest 5 sec of turbulence. Thus, nominal 
values of the sample standard deviation, not the specified uq , should be used. Values of 0, 17, 
and 34 were selected for TURBL, TURBM, and TURBH, respectively. 



Figure 22. Linear interpolation scheme for adaptive design. 
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Simulation results. To evaluate the detection and isolation performance of the adaptive 
design in a turbulence environment, simulation runs were made at specified turbulence levels 
oq of 0, 5, 10, 15, and 20 ft/sec with aircraft-path failures simulating partial effectiveness of 
each of the four surfaces: right stabilizer, rudder, right elevator, and right aileron. To evaluate 
false-alarm performance, three no-failure runs with different sample sequences for the turbulence 
were made at each of the same turbulence levels except zero, where only one run was made. As 
in previous runs, the failures occurred at t = 5 sec, and the climbing-turn maneuver CT4 was 
initiated at t = 10 sec. 

Results for the no-turbulence runs are tabulated in table 45. All four failures at 60-percent 
effectiveness were successfully detected, and the stabilizer and aileron failures were correctly 
isolated (the stabilizer to the right horizontal tail). The rudder and elevator failures at this 
failure level were isolated incorrectly. Failures at 80-percent effectiveness were not detected, 
but the two failures (rudder and elevator) at 40 percent were detected successfully and isolated 
correctly. Comparison with similar runs for the baseline design in table 13 shows that the BL 
design detected the rudder and aileron failures more quickly at 60-percent effectiveness, and 
the BL design detected one of four failures at 80-percent effectiveness. The BL design correctly 
isolated the rudder failure at 60-percent effectiveness. During the no-failure run, the adaptive 
design experienced no failures and only one false alarm, as did the baseline design. Thus, the 
adaptive design performed well in zero turbulence, although the baseline design was slightly 
better. 

Results for 5-ft/sec turbulence are shown in table 46. At 60-percent effectiveness, the 
stabilizer, rudder, and elevator failures were detected, and the stabilizer and rudder failures 
were correctly isolated by the adaptive design. Failures at 80 percent were not detected, but at 
40 percent the two failures were detected and isolated correctly. In three no-failure runs totaling 
168 sec of operation, no false alarms and no false triggers were experienced. This is the same 
as the no- failure performance of the interpolated design shown in table 33. 

Results for the adaptive design in 10-ft/sec turbulence are shown in table 47. All the failures 
at 40- and 60-percent effectiveness and two of the four at 80 percent were successfully detected. 
At 60 percent, the stabilizer and elevator failures resulted in undetermined failure declarations 
and were not isolated. The rudder failure was correctly isolated, even at 80-percent effectiveness. 
There were no false alarms and only two false triggers during three no-failure runs. Comparing 
the detection performance of the adaptive design with that of the PV10 design in table 30 
shows that the adaptive design detected all the failures that were detected by the PV10 design, 
except the right stabilizer failure at 80-percent effectiveness; the adaptive design detected two 
of the failures significantly quicker. Isolation performance of the two designs was nearly equal. 
False-alarm performance of the adaptive design was superior to that of the PV10 design and 
vastly superior to that of the BL design in table 15. 

As can be seen in table 48, in 15-ft/sec turbulence the adaptive system detected and isolated 
three out of three aircraft-path failures at 40-percent effectiveness, detected four of four and 
isolated two at 60 percent, but detected none at 80-percent effectiveness. In three no-failure 
runs, the system experienced two false triggers and one false alarm of the right horizontal tail in 
128.6 sec of operation. This result is slightly better than the interpolated design (see table 42), 
which missed two detections at 60-percent effectiveness and experienced the same false alarm 
and five false triggers under the same conditions. 

Table 49 contains results for the adaptive design for ctq = 20 ft/sec. Again, the system 
detected all the failures at 60-percent effectiveness (and correctly isolated three of the four) and 
no failures at 80-percent effectiveness. No false alarms and only one false trigger occurred during 
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Table 45. Failure-Detection and Isolation Performance for Adaptive Design 

With No Turbulence 


(a) Detection performance 


Failed surface 

Failure-detection time 0 

as a function of percent surface effectiveness 


0% 

20% 

40% 

60% 

80% 

Right stabilizer 




1.15 

b N 

r D 

Rudder 



1.85 

8.90 



Right elevator 



1.20 

6.70 



Right aileron 




22.20 




a Time of failure declaration relative to time of failure. b See symbol list for definition. 


(b) Isolation performance 



Failure isolation as a function of percent surface effectiveness 

Failed surface 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 



Yes 

a CS{RS,RE) 

a CS(RS,RE) 

a RT 

a RA 

Yes 

a ND 

4" 


“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

1 

^ 0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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Table 46. Failure-Detection and Isolation Performance for Adaptive Design 

With 5-ft/sec Turbulence 


(a) Detection performance 


Failed surface 

Failure- detect ion time“ 

as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 




1.50 

b ND 

Rudder 




24.05 

b ND 

Right elevator 



1.50 

7.25 

b ND 

Right aileron 



6.30 

b ND 



“Time of failure declaration relative to time of failure. 
6 See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 



a CS(RS,RE) 

Yes 

a CS{RS,RE) 

Yes 

a U(RA ) 
ND 

a ND 

a ND 

a ND 


“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time,“ sec 

1 

1 

0 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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Table 47. Failure-Detection and Isolation Performance for Adaptive Design 

With 10- ft/sec Turbulence 


(a) Detection performance 


Failed surface 

Failure-detection time a as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



LOO 

1.75 

b ND 

Rudder 




3.55 

40.20 

Right elevator 



1.50 

7.35 

b ND 

Right aileron 




6.75 

13.90 


a Time of failure declaration relative to time of failure. 
& See symbol list for definition. 


(b) Isolation performance 



Failure isolation as a function of percent surface effectiveness 

Failed surface 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 



a CS ( RS , RE) 
a CS (RS, RE) 

a U (LS, RS, LE, RE) 
Yes 

a U ( RA ) 

Yes 

a ND 

Yes 

a ND 

a U(LT) 


°See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

1 

0 


56.00 

2 

2 

1 

0 


56.00 

3 

3 

0 

0 


56.00 


a Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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Table 48. Failure-Detection and Isolation Performance for Adaptive Design 

With 15- ft /sec Turbulence 

(a) Detection performance 


Failed surface 

Failure-detection time 0 

as a function of percent surface effectiveness 


0% 

20% 

40% 

60% 

80% 

Right stabilizer 



1.15 

2.20 

6 ND 

Rudder 




1.85 



Right elevator 



1.40 

38.70 



Right aileron 



1.55 

39.70 

' 



a Time of failure declaration relative to time of failure. 
fe See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



a CS(RS,RE) 

a CS ( LS , LE ) 

a ND 

Rudder 




Yes 



Right elevator 



a CS ( RS t RE) 

a CS(RS ) RE) 



Right aileron 



Yes 

a U (LA, RA) 

> 



“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

1 

0 


56.00 

2 

2 

1 

1 

b RS, b RE 

16.60 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
^See symbol list for definition. 
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Table 49. Failure-Detection and Isolation Performance for Adaptive Design 

With 20- ft /sec Turbulence 


(a) Detection performance 


Failed surface 

Failure-detection time“ as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 




2.40 

6 A 

r D 

Rudder 




1.25 



Right elevator 



1.15 

1.60 



Right aileron 




1.60 


* 


°Time of failure declaration relative to time of failure. 
6 See symbol list for definition. 


(b) Isolation performance 


Failed surface 

Failure isolation as a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 
Rudder 
Right elevator 
Right aileron 



a CS ( RS , RE) 

a CS ( RS , RE) 
Yes 
a RA 
Yes 

“A 

J D 


“See symbol list for definition. 


(c) False-alarm performance 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time,“ sec 

1 

1 

1 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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the nofailure runs. This performance is considerably superior to that of the interpolated design 
(table 41), which missed four out of four detections at 60-percent effectiveness and two out of 
four at 40 percent in 20-ft/sec turbulence. Time histories of the trigger and verify statistics and 
thresholds for one of the nofailure runs are plotted in figure 23. Contrary to previous time- 
history plots, the thresholds in this case are not constant but vary as a function of the estimate 
of the turbulence level plotted in figure 23. Note the false trigger in the left-horizontal-tail 
channel at t « 6 sec. The verify tests for the left thrust, right thrust, left horizontal tail, right 
horizontal tail, and left aileron all fail (verify no failure) within 1 sec. The rudder and right 
aileron exceed the time limit at the end of 1 sec without making a decision. At that time, a 
false trigger is declared, and the aircraft-path subsystem resets and continues to operate. Thus, 
no false alarm occurred. 

Performance of the adaptive design is summarized in tables 50 and 51. In 688 sec of 
operation in turbulence from 0 to 20 ft/sec, the system experienced one false alarm and six 
false triggers. All partially missing surface failures at 40-percent effectiveness were detected and 
correctly isolated. At 60-percent effectiveness, 19 out of 20 were detected, and of these 11 were 
correctly isolated. When the surfaces failed at 80-percent effectiveness, the system performance 
degraded severely, as only 2 out of 19 failures were detected. The adaptive system performed 
well in turbulence levels where the baseline was completely unusable because of false alarms. 
Furthermore, previous simulation experience (ref. 26) has shown that this airplane and flight 
control system design are very robust to control-surface failures, and many smaller failures, such 
as those at 80-percent effectiveness, produce effects that axe hardly noticeable (thus, difficult to 
detect), let alone catastrophic. Therefore, missed detections at this level do not necessarily make 
the FDI system unusable. Also, it should be kept in mind that the turbulence levels referred to 
in the discussion were the specified levels, and the actual wind-gust sample sequences in most 
cases exhibited a sample standard deviation larger than the specified value. 

Summary of Results 

A procedure for designing a decentralized failure-detection and identification (FDI) system 
to detect and isolate control-element failures in aircraft control systems has been developed 
by Weiss and Hsu (NASA CR-178213). Using this procedure, Weiss designed a baseline FDI 
system, consisting of an actuator-path subsystem and an aircraft-path subsystem, for a modified 
Boeing 737 airplane. In the current report, this design was evaluated in detail by using a six- 
degree-of- freedom simulation of the airplane, including atmospheric turbulence based on the 
Dryden model. The design procedure was extended to improve performance of the system in 
turbulence. This extension resulted in the development of an adaptive FDI system, which was 
also evaluated in detail. 

Evaluation of the baseline design showed that when operated in a no-turbulence environment, 
the actuator-path subsystem performed very well. All actuator-path failures — stuck at neutral, 
stuck at current position, and handover — were detected in a timely manner; in the no-failure 
simulation runs, there were no actuator-path false alarms. The aircraft-path subsystem also 
performed well in zero turbulence. There were no false alarms, and partially missing surface 
failures of the stabilizer, rudder, elevator, and aileron were all detected when the remaining 
surface effectiveness was 60 percent. The right-stabilizer failure was isolated to the fictitious 
right horizontal tail, since the system cannot distinguish between stabilizer and elevator failures 
because of their identical effects. 
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Time, sec 

Figure 23. Aircraft-path trigger and verify statistics and turbulence level estimate. Adaptive design; no failure; 
20- ft /sec turbulence. 
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Tabje 50. False- Alarm Performance of Adaptive Design 


(a) No turbulence 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

1 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 


(b) 5-ft/sec turbulence 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

0 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 


(c) 10- ft /sec turbulence 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time, 0 sec 

1 

1 

1 

0 


56.00 

2 

2 

1 

0 


56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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Table 50. Concluded. 


(d) 15- ft /sec turbulence 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time“ sec 

1 

1 

1 

0 


56.00 

2 

2 

1 

1 

b RS, b RE 

16.60 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
& See symbol list for definition. 


(e) 20-ft/sec turbulence 


Run 

Random- 
sequence set 

Number of 
triggers 

Number of 
false alarms 

Isolated 

surface 

FDI active 
time “ sec 

1 

1 

1 

0 


56.00 

2 

2 

0 

0 


56.00 

3 

3 

0 

0 


56.00 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 


(f) Summary 



Number of 

Number of 

FDI active 


triggers 

false alarms 

time,“ sec 

6 

1 

688.60 


“Time aircraft-path subsystem is operational before being inhibited by a failure isolation. 
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Table 51. Summary of Detection and Isolation Performance of Adaptive Design 

(a) Detection performance 



Number of failures/number detected as 
a function of percent surface effectiveness 

Failed surface 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



2/2 

5/5 

5/0 

Rudder 



1/1 

5/5 

5/1 

Right elevator 



5/5 

5/5 

5/0 

Right aileron 



2/2 

5/4 

4/1 

All 



10/10 

20/19 

19/2 


(b) Isolation performance 


Failed surface 

Number of failures detected/number isolated 0 as 
a function of percent surface effectiveness 

0% 

20% 

40% 

60% 

80% 

Right stabilizer 



2/2 

5/3 

0/0 

Rudder 



1/1 

5/4 

1/1 

Right elevator 



5/5 

5/1 

0/0 

Right aileron 



2/2 

4/3 

1/0 

All 



10/10 

19/11 

2/1 


°Fbr stabilizer and elevator failures, isolated to horizontal tail (confusion set containing only stabilizer and 
elevator) . 


When the actuator-path subsystem was evaluated with model errors in the range of 5 to 
15 percent, stuck-at-current-position failures were reliably detected without false alarms. With 
larger model errors (12.5 to 37.5 percent), the same failures were still detected, but some false 
alarms were experienced. When the aircraft-path subsystem was operated at trim points in the 
vicinity of the design point, aircraft-path failures were reliably detected with no false alarms, 
but isolation performance was slightly degraded. At a trim point farther away (cruise instead of 
terminal area), the system was unusable because of false alarms. When moderate random errors 
were added to the aircraft-path model, the system was still able to detect failures at 60-percent 
effectiveness, although two false alarms occurred. 

In 10-ft/sec turbulence, the actuator-path subsystem continued to perform well. Again, all 
actuator-path failures were detected with no false alarms. On the other hand, the baseline 
aircraft-path subsystem was completely unusable in 10-ft/sec and higher turbulence because of 
the large number of false alarms. This result, plus examination of the residuals, indicated that 
many of the baseline values used in the truth model for the standard deviations of the errors 
in the residuals were too small. New values for the truth model in 10-ft/sec turbulence were 
obtained, and two new aircraft-path subsystem designs were produced. One of these, called 
new-threshold (TG) design, retained the old projection vectors but computed new gains and 
thresholds. The other, called new-projection- vector (PV10) design, was a totally new design. 
Both of these new designs performed well in 10-ft/sec turbulence and were far superior to the 
baseline design in false-alarm performance. There was a small edge in performance to the new- 
projection-vector design. However, performance of the new designs in zero turbulence was not 
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nearly as good as that of the baseline design, which indicated that some type of adaptive design 
was necessary for operation in atmospheric turbulence and that the adaptive process probably 
should include adaptation of the projection vectors as well as the gains and thresholds. 

When a new aircraft-path subsystem (PV20) was designed for operation in 20-ft/sec 
turbulence, the standard deviations of the errors obtained at 20-ft/sec wind gusts for the truth 
model were not large enough and had to be increased to obtain adequate false-alarm performance 
at that turbulence level. Thus, the design procedure at the higher turbulence levels needs 
refinement or the method of obtaining parameter values for the truth model needs improvement. 
Nevertheless, after the truth model was adjusted, the PV20 design performed well in 20-ft/sec 
gusts. At these higher gust levels, the baseline actuator-path subsystem also experienced some 
false alarms. Redesign of the actuator-path subsystem was not pursued because it was felt that 
if an adaptive aircraft-path subsystem could be successfully developed, similar techniques could 

be easily applied to the less complex actuator path. 

The design procedure was extended to produce an interpolated design for operation over a 
range of turbulence levels. This design was accomplished by linearly interpolating the thresholds, 
gains, and projection vectors between their baseline, PV10, and PV20 design values based on 
the FDI system’s knowledge of the turbulence level. In the interpolated design, this knowledge 
was supplied by the simulation user before each run as the specified value of the turbulence 
standard deviation for that run. The interpolated design performed well over the turbulence 
range of 0 to 20 ft/sec, but the design was impractical, or incomplete, in that the required 
knowledge of the turbulence magnitude is unknown in flight operation. 

A turbulence estimator was developed based on the technique used in the NASA F-8 digital 
fly-by- wire program. This technique estimates the sample standard deviation of the latest 5 sec 
of turbulence. This estimator was combined with the interpolated design to produce an adaptive 
aircraft-path subsystem. This adaptive design was evaluated in 0-, 5-, 10-, 15-, and 20-ft/sec 
turbulence and performed well over the entire range. It successfully detected and isolated all 
partially missing surface failures at 40-percent effectiveness, and it detected 19 out of 20 failures 
at 60-percent effectiveness. Only at the smallest failure magnitude (80-percent effectiveness) 
did performance degrade. Furthermore, in 688 sec of simulation time with no failures, there was 
only one false alarm. 

Although the decentralized FDI technique is robust to small model errors, and the extension 
of the technique to an adaptive system allows the system to operate in atmospheric turbulence, 
problems remain to be solved in the development of an operational FDI system. The two most 
urgent needs are (1) the continuation of the work reported in NASA CR-181664 to extend the 
system from a single operating point to operation over the entire operating envelope of the 
aircraft, and (2) flight testing to provide more realistic noise, or error, values for the truth 
models and to provide reliable false-alarm evaluation. 


NASA Langley Research Center 
Hampton, VA 23665-5225 
January 4, 1991 


97 


Commanded 

Estimated 

Measured 



Figure Al. Actuator positions and residuals for stuck right-aileron failure with no turbulence. 
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Figure Al. Continued. 
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Figure Al. Continued. 
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Figure A2. Actuator-path trigger and verify statistics for stuck right-aileron failure with 
turbulence. 
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Figure A2. Continued. 
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Figure A2. Continued. 
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Figure A3. Continued. 
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Figure A3. Continued. 
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Predicted 
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Time, sec 

F igure A4. Aircraft-path measurements and residuals for right-aileron partially missing surface 
failure (60-percent effectiveness). Baseline design; no turbulence. 



O HPF residual 
□ Residual error 
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Figure A4. Continued. 
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Time, sec 

Figure A5. Aircraft-path trigger and verify statistics for right- aileron partially missing surface failure 
(60-percent effectiveness). Baseline design; no turbulence. 
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Figure A5, Continued, 
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Figure A5. Concluded. 
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Figure A6. Aircraft path isolate statistics for right-aileron partially missing surface failure 
(60-percent effectiveness). Baseline design; no turbulence. 




Figure A6. Continued. 
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Figure A7. Actuator positions and residuals for stuck right- aileron failure with 10-ft/sec turbulence. 



Figure A7. Continued. 




Figure A7. Continued. 



Figure A7, Concluded. 
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Figure A8. Actuator-path trigger and verify statistics for stuck right-aileron failure with 
10-ft/sec turbulence. 








Signal 

Threshold 



Figure A8. Continued. 
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Figure A8. Continued. 
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Figure A9. Continued. 
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Figure A10. Aircraft-path trigger and verify statistics for baseline design with no failure, 
maneuver, and 10-ft/sec turbulence. 
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Figure A10. Continued. 
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Figure A 10. Concluded. 








Signal 

Threshold 



Figure All. Aircraft-path trigger and verify statistics for right-aileron partially missing surface 
failure (40-percent effectiveness). Interpolated design; 20-ft/sec turbulence. 




Figure All. Continued. 
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Figure A12. Aircraft-path trigger and verify statistics for right-aileron partially missing surface 
failure (60-percent effectiveness). Interpolated design; 15-ft/sec turbulence. 
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Figure A 12. Continued. 
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Figure A 12. Concluded. 
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